Our Methodology
Transparency
Story Investigation
How we research and publish scam exposés
1
Discovery & Sourcing
We continuously monitor blockchain networks, dark web forums, social platforms, and community reports to identify emerging scam patterns and active threats.
2
Deep Investigation
Our team traces transaction flows, analyzes smart contracts, examines wallet clusters, and documents scammer techniques through hands-on research.
3
Victim Outreach
We interview affected individuals (with consent and anonymization) to understand attack vectors and gather first-hand accounts of how scams operate.
4
Technical Analysis
Claims are checked against on-chain data, contract audits and forensic examination where that evidence exists. We cross-validate with independent sources.
5
Editorial Review
Stories undergo rigorous fact-checking, legal review, and editorial oversight before publication. We prioritize accuracy over speed.
6
Educational Framing
We present findings as educational content, teaching readers to identify red flags and protect themselves from similar threats.
Editorial Standards
Multiple Sources: At least two independent sources per claim
On-Chain Proof: Transaction data and contract analysis when applicable
Victim Protection: Anonymization of affected individuals
Corrections Policy: Errors acknowledged and corrected promptly
No Pay-to-Play: We never accept payment for coverage decisions
Educational Focus: Content designed to teach, not sensationalize
Ledger Verification & Provenance
Nothing lands in the Incident Ledger because a feed said so. Every candidate passes the checklist below — the exact same one our editor must tick inside the internal desk before any public page exists. If a required box stays unticked, the candidate does not ship.
Verification checklist
Two independent sources
required
At least two sources that do not cite each other. Two outlets rewriting the same press release count as one.One primary source
required
A statement from the affected project, a victim, a security firm's own analysis, an official filing — not an aggregator.On-chain confirmation
required
At least one transaction hash, contract or address resolved on a block explorer and matching the claim.Loss figure traced
required
The USD number is verified victim loss with a written basis. Estimates, 'up to' figures and TVL drops are never recorded as loss.Incident date confirmed
required
The date comes from on-chain timestamps or a primary statement, not from the publication date of an article.Not already in the ledger
required
Checked against existing incidents and investigations. Recurrences of an earlier case are linked, not duplicated.Victims anonymised
required
No private victim identities. Personal wallets are masked (0x1234…abcd); attacker-controlled addresses stay in full.Right of reply loggedOptional but preferred: the project's or exchange's own statement, or a note that none was published.
Provenance fields on every record
| Field | What it means | Where it comes from |
|---|---|---|
| incident_dateIncident date | When the theft or exploit happened, not when it was reported. | On-chain timestamp or primary statement. |
| loss_usdLoss (USD) | Verified victim losses only. Empty when the amount cannot be traced. | On-chain flows plus a written basis. Never estimates or TVL drops. |
| attack_vectorAttack vector | The mechanism that actually moved the money. | Transaction-level analysis or a security firm's post-mortem. |
| chainsChains | Networks where the incident is observable. | Block explorers. |
| indicatorsIndicators | Addresses, contracts, transaction hashes and domains tied to the case. | Explorer-resolved on-chain evidence, victim-supplied domains. |
| sourcesSources | Every citation behind the record, each labelled primary or secondary. | Minimum two independent sources, at least one primary. |
| statusStatus | confirmed, disputed or unverified — visible on the record itself. | Editorial review. Anything short of the full checklist stays unverified. |
| first_documented_at / last_verified_atDocumented / re-checked | When we first published the record and when we last re-checked it. | Automatic timestamps. |
| revised_at / revision_reasonUpdated + reason | Public correction line: what changed and why. | Logged automatically on every change to loss, status, severity or victim count. |
| story_slugInvestigation | The full public write-up, when one exists. | Our own investigation. |
From radar to record
- 1Radar inboxAuto-scored feed items. Nothing here is a claim yet.
- 2In reviewSources and on-chain evidence are being collected against the checklist.
- 3VerifiedEvery required check ticked. Only now may it become a draft or a ledger record.
- 4RejectedFailed verification. The reason is kept so the same rumour is not re-litigated.
Any later revision to a figure or a status stays in each record's public revision log on the internal incident record, with the date and the reason.
AI Scam Detector
How our detection engine analyzes threats
The detector fuses linguistics, domain intelligence, behavioral fingerprints, and real-time threat correlation into a single eight-layer engine. Each layer looks at the message from a different angle before a verdict is issued.
Eight-Layer Detection Engine
Every submission is passed through these eight layers before a verdict is issued.
Message Scan
10+ scam patterns detected instantly.10+ scam patterns shredded on contact — urgency, impersonation, credential theft.
Screenshot Analysis
Up to 3 images — forgeries exposed.Up to 3 images. Forged UIs, fake receipts, doctored trading wins — cracks exposed.
URL X-Ray
Phishing, drainers, shortened links.Phishing domains, typosquatting, wallet drainers, shortened links — all dissected.
Blacklist Intel
Live check vs threat-intel feeds.Real-time cross-check against URLhaus and threat-intelligence feeds.
Visual Threat
OCR + AI catches spoofs and QR traps.OCR + AI vision catches brand spoofs, QR traps and edited screenshots.
Actionable Verdict
Risk 0–100 + clear next step.Risk 0–100, threat category and exactly what to do next. No vague maybes.
Confidence Floor
Critical threats never downplayed.Hard evidence is never downplayed — critical threats are floored to high.
Wallet & Blockchain Check
Ethereum/TRON facts + threat labels.Ethereum/TRON activity, USDT flows, contract status and GoPlus labels, with explorer links.
Notice:Risk assessments are probabilistic. Highly accurate, not exhaustive — always verify through official channels.Probabilistic — always verify officially.
Analysis Pipeline
1
Input Processing
Text normalization, URL extraction & wallet address detection
2
Signal Extraction
Pattern matching across 60+ indicators
3
Threat Correlation
Cross-reference with threat intel
4
Risk Scoring
Weighted aggregation & calibration
Data Sources & Intelligence Partners
Our detection engine aggregates intelligence from multiple trusted sources to maximize coverage and accuracy:
Public Threat Feeds: Community-maintained blocklists and phishing databases
Domain Intelligence: WHOIS data, SSL certificate analysis, DNS records
Blockchain Analytics: On-chain transaction patterns and wallet clustering
Community Reports: User-submitted scam samples (anonymized)
Academic Research: Published studies on cryptocurrency fraud patterns
Proprietary Analysis: Patterns identified from our own investigations
Known Limitations
No system catches everything. Ours included.
Novel Attacks
New scam techniques may evade detection until patterns are identified and integrated.
Context Gaps
The scanner analyzes text in isolation without full conversation context or sender verification.
False Positives
Legitimate messages with urgency language may occasionally trigger warnings.
Wallet Checks Are Surface-Level
On-chain wallet lookups (Ethereum, Polygon, Arbitrum, TRON) show public facts and threat labels — a quick surface check, not a full risk profile.
No Label ≠ Safe
Absence of threat-intel labels does not guarantee an address is safe. Feeds depend on external providers (Etherscan, TronGrid, GoPlus) and data can be unavailable.
Language Scope
Primary optimization for English. Detection accuracy may vary for other languages.
Some scams still slip through. Usually the boring ones. Or the new ones.
If two stories look the same — that's intentional. That's how scams survive.
Data Handling & Privacy
Zero Retention
Submitted content is processed in real-time and immediately discarded. No logs, no storage.
Encrypted Transit
All analysis occurs via TLS 1.3. Data never leaves our secure infrastructure.
No Tracking
We don't correlate analysis requests with identities. No cookies for analysis.
Privacy First
Architecture designed for minimal data exposure. No third-party sharing.
Detection Performance
Internal evaluation, data from Q3–Q4 2024, not independently audited.
94.2%
Precision
True positive rate
91.8%
Recall
Detection coverage
2,847
Test Samples
Labeled dataset
Evaluation methodology: Metrics derived from internal testing on a curated dataset of 2,847 labeled messages (1,523 confirmed scams, 1,324 legitimate). Dataset includes phishing, fake airdrops, impersonation, and investment fraud samples collected Q3-Q4 2024.
Important caveats: Real-world performance may vary. Novel attack patterns not in our training data will have lower detection rates. These metrics represent a point-in-time evaluation; we continuously update our models as new threats emerge. False positive rate ≈5.8% on legitimate crypto-related messages.
Changelog / Version history
Nothing here is static — scammers mutate, so do we. This is the paper trail of what changed and when.
- v3.0July 2026Eight-layer engine
Expanded the original 4 signal categories into 8 independent layers (linguistic, domain, on-chain, contract, behavior, threat intel, context, verdict).
- v2.2May 2026On-chain wallet reputation
Correlation against addresses flagged for drainers, mixers, and known honeypots.
- v2.0February 2026Bilingual EN/ES parity
Detector, methodology, and stories reach parity across English and Spanish.
- v1.0November 2025Public launch
Initial detector with 4 signal categories and a zero-retention policy.
Important Disclaimer
CryptoStrapon provides educational content and tools for informational purposes only. While we strive for accuracy, no investigation or automated system can guarantee 100% completeness or detection. Always exercise independent judgment, verify information through multiple sources, and never share private keys or seed phrases with anyone. Our content does not constitute financial, legal, or security advice.
We don't chase scammers. We document playbooks.