Every tool
Pattern matching in your browser, on wording that scams reuse. It runs entirely on this device and the message is never sent anywhere. A clean result is not a guarantee: a careful scam can pass every check here. An unprompted message about your money deserves suspicion whatever this says.
This tool never asks for a wallet connection, a signature, or a recovery phrase, and neither does anything else on this site. If a page ever asks you to "verify" or "sync" your wallet by typing your twelve or twenty four words, that page is the attack. There is no exception to this and no legitimate reason it would ever be needed.
Once you see them you cannot unsee them
Manufactured urgency
Your account will be suspended, the airdrop ends in an hour, act now. Urgency exists to stop you checking. Nothing legitimate about your money needs a decision in the next ten minutes.
A request for your words
Framed as verification, migration, recovery or support. There is no version of this that is real. Support cannot use your seed phrase for anything except taking everything.
A link that is not what it says
The text reads like the real site and the destination does not. Lookalike domains swap a letter, add a hyphen, or use characters that render like Latin ones.
Free money with a catch
An airdrop, a giveaway, a refund, a doubling. The catch is always a signature or a small payment first, and the small payment is the whole point.
In this order
Do not sign anything else
If a wallet prompt is open, close it. A signature is what actually moves your money, not the click that got you there.Move what you can
If you signed something and still hold assets, send them to a wallet made from a different recovery phrase. Not a different account in the same wallet, a different phrase.Revoke the approvals
A drainer usually relies on a permission you granted, which keeps working until you take it back. Our guide on token approvals covers how.Assume the phrase is gone
If you typed your recovery words anywhere at all, every wallet from that phrase is compromised forever, on every chain. A new phrase is the only fix.
Common questions
Is my message sent to a server?
No. The checks run in JavaScript in your browser and there is no request to anything when you use this tool. You can open your browser network tab and watch. The site has no database and nothing to store it in.
It says no red flags. Am I safe?
No, it says the common patterns are absent. A well written, targeted scam has no urgency, no bad grammar and a clean domain. Treat a clean result as one weak signal and keep the rule that matters: never act on an unprompted message about your money, and never enter a recovery phrase for any reason.
It flagged a message from a real company.
That happens, because real companies use urgency and short links too. The flags name what is suspicious about the wording, not who sent it. Check the sender independently, by typing the company's address in yourself rather than following any link in the message.
Should I reply to find out if it is real?
No. A reply confirms a live human is reading, which is worth money and gets you sold to other operators. Verify through a channel you found yourself.
Want a hand using these on your own position?
We go through it together on a call. Your holdings, your risk, your setup. You click everything and we never ask for keys.