What a scan is
A scan reads what anyone could look up about a project's website: registries, public lists, the archive and the home page as a visitor sees it. We never connect a wallet, sign a transaction or deposit anything. The project is non-commercial: no ads, no paid placements and no ratings.
We keep a list of projects we follow and scan them on a schedule. Any other address we have data for can be looked up too; each reading shows when it was taken.
The parts of a report
Threats
Whether the project's address is on a public phishing feed or a crypto phishing list right now, and when it was last seen there, and whether its name imitates a well-known crypto project (metamask-claim.app for metamask.io). Fake exchanges, wallet drainers and fake airdrops show up here first. For a genuine project we also list the fakes of it that the MetaMask phishing list holds, as plain text you should never open.
Sources: OpenPhish and phishunt.io (every 6 hours); the MetaMask phishing list and its allowlist of genuine domains, and the ScamSniffer database, whose public copy is 7 days behind (every 6 hours).
Who is behind it
When the domain was registered and through which registrar, whether the owner hides behind a privacy service, and how the site names itself. A project claiming years of history on a domain registered last month is a classic warning. When the Internet Archive saved the address more than 30 days before its current registration date, the name lapsed once and was registered again, possibly by someone who now trades on its old reputation: a caution for 2 years, then a note, and the older archive history earns no credit.
Sources: RDAP registries (weekly), the home page (every 12 hours).
How long it has been around
The first copy saved by the Internet Archive, and where the domain sits among the most visited websites.
Sources: Wayback Machine (monthly), Tranco list (daily).
DeFi data
Whether the project is in the DefiLlama catalog of protocols and exchanges, since when, the value locked in it (for an exchange, the reserves DefiLlama tracks), the chains it runs on, the audits the catalog reports, and the hacks it records. Most exchangers, wallets and new projects are not in the catalog: that alone is not a warning.
Sources: DefiLlama (daily).
What the site promises
Promises and claims in the text of the home page: guaranteed or daily returns, multi-level referral schemes, and claims of an audit or a licence. They are the site's own words, so we report them without verifying them. A form field or an instruction to type in a seed phrase, a recovery phrase or a private key is a red flag on its own: that is how wallet drainers empty wallets, and no genuine service needs it. Warnings such as "never share your seed phrase" don't count.
Sources: The home page (every 12 hours).
Can it be hijacked
Whether the domain is locked against transfers at the registrar or the registry, whether its DNS is signed (DNSSEC), the HTTPS certificate, and whether emails in its name can be faked. Real projects have lost their front end, and their users' funds, through a hijacked domain.
Sources: RDAP (weekly), our own TLS handshake (every 12 hours), DNS (daily).
How the verdict is decided
- Red flags when something is serious: the address is on a phishing feed or a crypto phishing list now, its name imitates a well-known crypto project, the home page promises guaranteed or daily returns, the domain is younger than 3 months, or the HTTPS certificate is broken.
- Check before you deposit when something deserves caution: a phishing report in the last 30 days, a multi-level referral scheme, a hack recorded in the last 2 years, a domain younger than a year, a registration that ends within 30 days, or no DMARC record, so emails can be faked in the project's name.
- Nothing alarming when none of that applies and we have both the registration date and a certificate check.
- Still collecting data when one of those two is missing. Such reports stay out of search results until the data arrives.
Good signs sit next to the verdict but never cancel a warning: a place in the DefiLlama catalog, a domain or an archive history of 5 years or more, and a place among the 100,000 most visited websites. Claims of an audit or a licence are shown as the site's words, never as a good sign.
What our team verifies by hand
Some projects ask us to check them. A scan reads public data; these checks are done by a person, with the project and with official sources. A check appears on a report only after it passed, it is a good sign that never cancels a warning, and a project without it isn't suspicious for that reason.
- Regulated company: We found the company behind this project in an official register of crypto service providers. The entry is active and names this domain.
- Official addresses: The team confirmed these addresses to us with a message signed by the deployer address or a file on this domain. A token or contract that uses the project's name at another address is not theirs.
A check holds for 12 months, then we verify it again or it disappears. We suspend a check at once when a warning or a complaint contradicts it. A licence in one country says nothing about another, and confirmed addresses only tell you which contracts are the project's, not that they are safe.
What a scan can't see
- Smart contracts: a clean website can still sit on top of a buggy or malicious contract.
- Custody and solvency: whether an exchange actually holds your funds.
- The team: who really runs the project, and whether they will still be there tomorrow.
- New scams: a site that went live an hour ago may not be on any list yet.
A report is one input, never a guarantee and never financial advice. Before you connect a wallet, make sure the address is exactly the one the project publishes on its official channels.
Sources
Phishing data: OpenPhish, phishunt.io, the MetaMask phishing list and the ScamSniffer database. DeFi data: DefiLlama. Domain data: RDAP registries, the Internet Archive and the Tranco list.
Corrections
Something wrong about your project? Write to [email protected] with the domain. Mistakes in our own processing are fixed quickly; for a third-party list we point you to its maintainers.