Scan a QR before you trust it

It's a free tool that takes any URL or domain and checks it against 7 independent security databases — MetaMask's own phishing blocklist, ScamSniffer, GoPlus, URLScan.io, OpenPhish, Google Safe Browsing, and VirusTotal. It returns a red, yellow, or green result based on what those databases report. We do not make our own determination — we surface what the security community has already flagged.

No — not in readable form. The checker needs no account and no wallet connection. To keep it fast, a repeated check of the same address or URL is served from a short-lived cache, but that cache is keyed to an irreversible one-way fingerprint of what you entered, not the address or URL itself. The usage counter records only that same fingerprint. There is no way to work backward from what we store to what you checked — consistent with our rule that SusuFinance never links an address to a person.

It means one or more of the security databases we query has reported that domain. It does not mean we are calling it a scam — that determination comes from the third-party database. You should treat a red result as a serious warning, do your own additional research, and not connect your wallet until you are certain the site is legitimate.

Yellow means the site is not in any blocklist, but it also has little or no security scan history — so there's not enough data to give a clean bill of health. New sites, obscure domains, or recently registered addresses often show yellow. Proceed with caution and verify the site through official channels before connecting.

No. A green result means the site hasn't been reported to any of the databases we check — not that it's definitively safe. Brand-new phishing sites get a few hours before they're added to blocklists. Always double-check the exact URL in your browser bar, look for the official social media accounts, and never connect a wallet from a link sent in a DM or email.

A wallet drainer is a website that mimics a legitimate dApp — a fake NFT mint, a fake token claim, or a fake airdrop. When you connect your MetaMask and sign a transaction, you're actually signing a permission that lets the attacker transfer every token out of your wallet in one move. The entire balance can be gone in seconds. The site often disappears within hours.

A honeypot is a token you can buy but never sell. The scammer promotes it, you buy in, the price appears to rise — but when you try to sell, the contract blocks you. The scammer then drains the liquidity and disappears with your ETH.

Guaranteed daily returns of 1–10%, "just stake your tokens in our wallet," airdrop claims that require sending tokens first, or someone in DMs offering to double your crypto. If the return sounds impossible in traditional finance, it's a scam in crypto.

Tornado Cash is a mixer that breaks the on-chain link between wallet addresses. While some users value privacy, it's heavily used by scammers and hackers to hide the origin of stolen funds before cashing out.

No. Scammers often seed wallets with worthless tokens or inflated "paper" balances to create the appearance of legitimacy. Always check if those tokens can actually be sold and what they're truly worth.

Not always — but in the context of someone pitching an investment, a wallet created in the last 30 days is a major red flag. Legitimate protocols and businesses have established on-chain history.

Do not send funds. Screenshot the results. If someone is pressuring you to send crypto to a flagged address, that pressure itself is part of the scam. Report the address on chainabuse.com and walk away.

Do not connect your wallet. Close the tab. Find the official project through a trusted source — their verified Twitter/X account or a well-known aggregator like DeFiLlama or CoinGecko. Report the site to MetaMask's phishing database at github.com/MetaMask/eth-phishing-detect.

It depends on the mistake. Sending to an address on the wrong blockchain — ETH to a Bitcoin address, or BTC to a Solana address — means those funds are gone. The two networks have no way to communicate and no one can reverse an on-chain transaction. The most common version on EVM chains is sending on the wrong network: an Ethereum address and a Polygon address look identical (both start with 0x), so ETH sent to the right address on the wrong network is inaccessible unless you or the recipient can access the wallet on that other chain. Always confirm the chain before sending, not after.