04 · Scam check
Paste a DM, a tweet, an email or a link.
Wording rules
Each rule adds weight. Examples: seed phrase or private key requests (45), "validate / sync your wallet" (30), guaranteed returns or doubling (25), airdrop and claim bait (22), unsolicited support (20), artificial urgency (18), "you have been selected" (15), Cyrillic letters (12), cheap phishing TLDs (10), moving you to Telegram or WhatsApp (8).
Links
Every link is resolved to its registrable domain and checked against:
- the MetaMask eth-phishing-detect blocklist (and its allowlist, which wins);
- the ScamSniffer domain blocklist;
- homoglyph / punycode hosts, brand imitation (a wallet or exchange name inside another domain), raw IP hosts, and claim / verify / sync paths.
The lists weigh several megabytes, so they are served by a small serverless cache (/api/lists) refreshed hourly. If it is unreachable the page says so and scores wording and addresses only.
Addresses
Every 0x address in the text is checked against the ScamSniffer address blocklist (loaded directly in the browser).
Score
| Score | Verdict |
|---|---|
| 0 – 24 | clean |
| 25 – 59 | sus |
| 60 – 100 | rug |
A blocklist hit alone is worth 50. Absence from every list proves nothing: new kits appear daily. The findings explain each point so you can judge the message yourself.