Crypto link checker

Not in a browser. Wardcrest’s server asks for the page, follows up to five redirects and reads the first 256 KB of its HTML as text, so nothing on the page runs and your device never touches it. Every request goes through a guard that refuses private and reserved network addresses.

No. It is sent in the body of the request rather than in the page address, so it stays out of access logs, and it is never written to the database or the logs. The result stays in the server’s memory for five minutes, filed under a hash of the link, so the same link pasted twice costs one check.

Not on the strength of this check alone. Many drainer kits load their code after the page opens, show checkers a harmless page, or change within hours. Open sites from the project’s own documentation or your bookmarks, and read every request with the signature request decoder before you approve it.

Drainer sites are set up for one campaign and dropped once wallets start warning about them, so most are days old when their links go round. A project you already use will have had its domain for years. The date comes from the registry’s RDAP service; .io, .co and most country endings do not publish one.

It compares the domain with the real domains of about 160 crypto brands: letters swapped for lookalikes from other alphabets, 0 for o, “rn” for “m”, the name with another ending, on a free host, in front of someone else’s domain, or next to words like “claim” and “verify”. A brand’s own domains are never flagged.

If you signed anything, find out what it allowed: the token approvals checker lists the contracts that can still spend your tokens and how to revoke them from your own wallet. If you typed your recovery phrase anywhere, move everything to a new wallet at once: a revoke cannot help then.