How scoring works
Every verdict is a sum of individual signals, each shown to you with the points it contributed. Nothing is hidden behind a single number.
The score
Signals combine additively on a 0–100 scale, capped at 100. Additive scoring is a deliberate simplification: it is explainable, which matters more here than statistical calibration. The trade-off is that several mild signals can stack, so individual weights are kept conservative.
| Band | Score | Meaning |
|---|---|---|
| Clear | 0–9 | No signals found |
| Low | 10–29 | Minor signals, likely benign |
| Medium | 30–54 | Worth reviewing before you transact |
| High | 55–79 | Strong signals — treat with caution |
| Severe | 80–100 | Confirmed high-severity match |
Data sources
OFAC Specially Designated Nationals list
BSC + EthereumThe US Treasury sanctions list, refreshed nightly. A match is authoritative and saturates the score on its own. Applied to both chains, because an EVM address derives from its keypair — the same sanctioned party controls the same address everywhere.
Tornado Cash pool and router contracts
Ethereum onlyOFAC-designated mixing contracts, verifiable on Etherscan. Scoped to Ethereum deliberately: these are deployed contract addresses, so the identical string on BSC is an unrelated address and flagging it would be a false positive.
On-chain state via JSON-RPC
BSC + EthereumBalance, nonce, and bytecode. Requires no API key, so a verdict is always possible even when other providers are down.
Transaction history via Etherscan V2
BSC + EthereumOptional. Supplies address age, inbound/outbound balance and counterparties. Without it, those three checks are skipped and the result is marked as a partial scan.
Signals
- Sanctions match
- Exact match against the SDN list. Contributes 100 — dispositive, and no other signal can offset it.
- Mixer contract
- The address is itself a known mixing contract. Contributes 85.
- Reported for abuse
- Appears in community abuse feeds. Weighted by the feed's own severity, with a bonus when independent feeds corroborate each other. Capped at 90.
- Counterparty exposure
- Transacted with flagged addresses, discounted steeply by hop distance — 40% at one hop, 12% at two, ignored beyond that, because the transaction graph fans out enormously and distant links carry little meaning. Capped at 55.
- Smart account delegation (EIP-7702)
- Informational when the delegate is unremarkable. Critical when the delegate is flagged: a hostile delegate can move assets out of the account, and revoking it is urgent.
- Address age
- Addresses under a day old contribute 12, under a week 8, under a month 4. Low weight by design — every legitimate new user also starts here.
- Pass-through pattern
- Many inbound transfers promptly forwarded to very few destinations, characteristic of a collection or drain wallet. Contributes 20.
Limits you should know
- A clear result is not a safety guarantee. It means the address is not on the lists we check and shows no pattern we recognise. Newly created scam addresses look clean until someone reports them.
- BSC coverage is weaker than Ethereum coverage. Most BSC fraud is token-level — honeypot contracts, rug pulls, fake BEP-20s — and we do not yet analyse token contracts. Our checks are address-level.
- Mixer exposure is not proof of wrongdoing. Privacy tools have legitimate uses. Indirect exposure is discounted steeply by distance for this reason.
- Without a transaction-history provider the scan is partial. When that happens we label the result as a partial scan and name what was skipped, rather than quietly returning a thinner verdict.
- This is not legal advice and not a sanctions compliance determination. For compliance decisions, consult the primary sources directly.