Plumbline

Check a link or wallet
before you trust it.

Paste a link or a TON wallet address into Telegram. Plumbline looks at the domain, the page and the wallet history, then tells you what it observed and how concerned to be.

Open in Telegram How the checks work

What a result looks like

Every verdict lists the observations behind it and ends with the same caveat. These are illustrative examples produced by the bot's own checks and message formatter, not real customer lookups.

Dangerous
Link

tеlegram.org

Observations

  • The domain imitates Telegram using look-alike characters (tеlegram.org); the real site is telegram.org.
  • The domain mixes different alphabets in one name (tеlegram), a technique used to imitate other sites.
  • The domain uses non-Latin characters (shown as tеlegram.org).
  • The domain is under three months old (40 days).

Absence of findings is not a guarantee. Use your own judgement.

Suspicious
Link

claim-ton-bonus.xyz/connect-wallet

Observations

  • The domain was registered 6 days ago.
  • The address contains wording often used in wallet-theft pages: claim, bonus, connect-wallet.
  • The page prompts you to connect a wallet.
  • The “.xyz” suffix is frequently used for short-lived sites. This alone proves nothing.

Absence of findings is not a guarantee. Use your own judgement.

Caution
Wallet

EQDtFp…74p4q2

Observations

  • The first activity was 4 days ago.
  • It received transfers from 24 different addresses within about 12 hours, a pattern seen with collection wallets.

Absence of findings is not a guarantee. Use your own judgement.

Four levels exist: Dangerous, Suspicious, Caution and No known threats found. Plumbline never says a link or wallet is safe.

What it checks

Links

  • Lookalike and punycode domains against a list of 31 Telegram, TON, wallet and exchange brands
  • Domain age from the registry (RDAP)
  • Shortened links, expanded and followed safely through up to five redirects
  • Page prompts for seed phrases, wallet connections and passwords, read from the HTML without running scripts
  • A community-maintained phishing blocklist

TON wallets

  • Address validation across friendly, raw and testnet formats
  • Account state, first activity and balance
  • Activity patterns such as collection wallets and pass-through behaviour
  • Transfers involving addresses that have been flagged
  • Community reports, shown only after several people report

What it will not do

  • Call anything safe
  • Name or accuse a person or company
  • Run a page's scripts or open it in a browser
  • Keep your history for more than 30 days

Read how each check works and where it falls short.

Plans

Free gives you 5 checks a day. Pro adds unlimited checks, the full report and daily watchlist alerts, paid in Telegram Stars. See pricing.