Crypto Scam Detector
AI-Powered Analysis
Paste Message, URL, or Wallet
Drop that sketchy DM, phishing email, shady URL, or a wallet address on Ethereum, Polygon, Arbitrum, Base or TRON — we'll check it
0 / 5,000
Try a sample case
Security note
Never paste private keys or seed phrases.
Private scan
No login · No wallet
Scan results will appear here
Paste a message or URL and click scan to get started
Free · Private · No login required
Message Scan
10+ scam patterns detected instantly.10+ scam patterns shredded on contact — urgency, impersonation, credential theft.
NewFake exchange alerts after big hacks: SAFU refunds, unlock withdrawals, fake support.
Screenshot Analysis
Up to 3 images — forgeries exposed.Up to 3 images. Forged UIs, fake receipts, doctored trading wins — cracks exposed.
URL X-Ray
Phishing, drainers, shortened links.Phishing domains, typosquatting, wallet drainers, shortened links — all dissected.
NewFlags "Binance" links outside official domains, lookalikes included.
Blacklist Intel
Live check vs threat-intel feeds.Real-time cross-check against URLhaus and threat-intelligence feeds.
Visual Threat
OCR + AI catches spoofs and QR traps.OCR + AI vision catches brand spoofs, QR traps and edited screenshots.
Actionable Verdict
Risk 0–100 + clear next step.Risk 0–100, threat category and exactly what to do next. No vague maybes.
Confidence Floor
Critical threats never downplayed.Hard evidence is never downplayed — critical threats are floored to high.
Wallet & Blockchain Check
Wallet, token and NFT public evidence.Ethereum, Polygon, Arbitrum, Base and TRON facts; EVM token/NFT evidence where available. Base transfer history uses Alchemy first when available; capped, not lifetime transactions.
NewWatchlist: addresses auto-checked against major-hack and sanctions lists.
Notice:Risk assessments are probabilistic. Highly accurate, not exhaustive — always verify through official channels.Probabilistic — always verify officially.
Share This Tool
Help others stay safe from crypto scams
What this crypto scam detector checks
Here is what it looks at on every scan:
- Links and domains — typosquatting, lookalike domains, shorteners and raw-IP URLs.
- Wallets and transactions — activity, age and stablecoin movements on Ethereum, Polygon, Arbitrum, Base and TRON.
- Tokens, memecoins and NFTs — sellability, hidden taxes, creator powers, supply and liquidity.
- Message text and screenshots — manufactured urgency, seed-phrase requests, fake "support", fake exchange alerts after big hacks and visible addresses.
- Watchlist check — every wallet address is checked against lists of hack-linked (incl. Binance 2026), sanctioned and compromised wallets.
- Overall pattern — a 0–100 score with a clear level and the reason behind every signal.
It is not an oracle. It is a second opinion that takes a minute and saves your wallet.
Checks in the last 30 days
66 checks · 28 flagged
Last 30 days · anonymised
66
on-chain checks
28
with scam signals
NetworkWalletsTokensNFTAlerts
Base14271423
Ethereum401316
Polygon400014
Arbitrum360010
TRON3000
Updated 4 Nov, 13:48 UTC · latest check 3 Nov, 13:45 UTC
A network counts only when the address has activity or a contract there; a check spanning several networks counts once in the total. Our internal test scans are excluded from 24 October 2026, 15:00 UTC; earlier ones may still be included.
Learn About Specific Scam Types
Offered Flash USDT? Read Flash USDT vs real USDT and the USDT contracts on TRC20 and ERC20. The Flash USDT scam investigation explains how the counterfeit is sold. A risk report does not prove you received a genuine payment.
Critical Threat
Wallet Drainer Attacks
How scammers steal millions through fake approvals and malicious signatures
SEC_SYSTEM_AUTH //
Social Engineering
Fake Airdrop Scams
Survey scams and eligibility checkers that drain your wallet
DIST_LIST_CHECK //
Physical Fraud
Phishing Mail Attacks
Physical mail crypto fraud targeting hardware wallet users
OFFLINE_VEC_IDENT //
AI Manipulation
Deepfake Job Scams
AI-generated recruiters stealing developer credentials
SYNTHETIC_ID_DET //
Token Spoofing
Flash USDT Fraud
Counterfeit stablecoin tokens flooding Telegram groups
ASSET_VERIFY_ERR //
Yield Fraud
Crypto Ponzi Schemes
Investment fraud with guaranteed return promises
PYRAMID_VEC_ANALYSIS //
Wallet Checks & Detector FAQ
It looks for phishing, fake domains, wallet drainers, malware, bogus airdrops, impersonation and other common fraud signals. It also reads the message around the link. That is often where the con lives.
Yes. Paste the full SMS, email or message. After the Binance hack, the detector flags SAFU refunds, fake support numbers, "unlock your withdrawals" requests and Binance links outside official domains. Wallet addresses are checked against major-hack and sanctions lists. We don't trace or recover funds: we flag patterns.
Yes. No account and no card required. Paste the message or link and get a risk assessment in about a minute.
Yes. Paste a full address — Ethereum, Polygon, Arbitrum, Base or TRON — or a transaction hash, straight into the detector. Available checks include public activity, recent USDT transfers and senders, contract status and GoPlus labels, depending on the network and provider response. Base uses RPC for code/balances and Alchemy (Base) first for capped transfer history, first/last observed activity and USDC flows when available; unavailable history is never zero activity. No public threat label is not proof that a wallet is safe, so add the message that came with it for the full con.
Yes, on Ethereum, Polygon, Arbitrum and Base. The report shows GoPlus token taxes, honeypot and owner-power data, DexScreener pool snapshots, and NFT standard, supply, owners and creator powers when available. A metadata sample is not the whole collection. Similar names do not prove cloning; NFT concentration and marketplace restrictions may be unavailable. No public warning is not proof of safety.
Yes. Paste the full message, not just the link. The detector checks urgency, pressure, impersonation, credential requests and other social-engineering tricks.
It checks supplied domains for spelling and brand-lookalike patterns and assesses any login text or screenshots you submit. An HTTPS padlock does not make a thief respectable.
Yes. It checks the supplied domain and looks for approval patterns in the text or calldata you paste; it does not inspect a live wallet connection. A real airdrop never needs your seed phrase.
It looks for guaranteed returns, pressure to deposit more, fake trading platforms and manufactured relationships designed to win trust before taking money.
Yes. Paste the offer or link. It looks for fake interviews, suspicious code, malicious packages and company impersonation.
No. It is an educational risk assessment, not a guarantee. If something still smells wrong, do not connect, sign or pay. Verify it elsewhere.