How the look-alike trick works: The Address That Looks Like Yours
Save your funds. Save your time. Save your trust. Save the regret.
Each ecosystem uses its own address format and its own validator — a Solana address is never accepted where an EVM address is expected, or the reverse.
Data is pulled live from GoPlus Security's public API. The checks themselves differ by chain — Solana's mint/freeze authority model isn't force-fit into EVM's contract-function model.
A single confirmed severe finding always means FAIL. Missing or unreadable data never quietly becomes a clean PASS — it's reported as insufficient data instead.
The text you paste is analysed on this page. Nothing is sent, stored or seen by us, and nothing reaches an advertiser.
It looks for invisible characters, concealed markup, encoded payloads, disguised links, requests for recovery phrases, keys or logins, and hidden instructions aimed at AI assistants. Addresses in the text can then be checked one by one.
A critical finding always means FAIL. Minor signals alone never add up to FAIL, and text that explains a trick is weighed differently from text that uses it. A clean result means no covered pattern matched, not that the message is safe.
The package name and version go to the npm registry and to OSV.dev, Google's open vulnerability database. The package's code is never downloaded or run.
Whether npm removed it, whether OSV.dev reports it as malicious or vulnerable, what its install script does, whether its name imitates a popular package, and whether this release looks hijacked next to the package's own history.
A malicious report, an npm security takedown or an install script that pipes downloads into a shell means FAIL. Sources that do not answer count as unknown, never as a pass, and every result lists what was not checked.
Plain-language guides to the scams this scanner checks for.