How it works

Plumbline collects observations, weighs them, and reports both. This page describes the real checks, including their limits.

From observations to a verdict

Each check produces plain-language observations with a weight. The verdict level comes from those weights:

• Dangerous needs hard evidence: a listing in the phishing blocklist, a look-alike imitation of a known brand, a link that runs code, a site that imitates a known service while asking for a wallet connection or password, or an address a maintainer flagged after review. A pile of weak signals cannot reach Dangerous.
• Suspicious means several meaningful indicators add up.
• Caution means one or two weaker indicators, such as a very new domain.
• No known threats found means none of the checks found anything. It is not a statement that something is safe.

Link checks

Normalising and reading the address

The link is parsed and normalised. Unusual IP notations, credentials before an “@”, long addresses, many subdomains and risky suffixes are noted. Internationalised domains are decoded from punycode so you can see what they really spell.

Lookalike detection

The domain is compared with a maintained list of 31 brands covering Telegram, Fragment, TON apps, major wallets and exchanges. Plumbline folds look-alike characters (Cyrillic and Greek letters, digits such as 0 and 1 used for letters), flags names that mix alphabets, one-character typos, a brand name used as a subdomain of another site, and a brand name combined with words like “claim” or “verify”.

Domain age

The registration date comes from the registry's public RDAP service. Domains registered days ago are a common sign of a throwaway site. Sites on shared hosting platforms are not judged by the platform's age.

Shorteners and redirects

Shortened links are expanded. Plumbline follows at most five redirects and judges the final destination as well as the link you sent.

Reading the page

The page's HTML is downloaded (at most 512 KB) and read as text. Plumbline looks for fields asking for a seed phrase or private key, wallet-connection prompts, password forms, forms that send data to another site, and titles that name a brand the site does not belong to. Scripts are never run, so content that only appears after scripts execute is not seen.

Safe fetching

Before a page is fetched, its address is resolved and checked. Private, loopback, link-local and cloud-metadata addresses are refused, again on every redirect. Only ports 80 and 443 are used, with short time limits.

Blocklist

Domains are matched against Phishing.Database, a community-maintained phishing list published under the MIT licence. Only hashes of its domains are stored.

Wallet checks

The address is validated, including its checksum, and normalised so every format of the same wallet is treated as one. Data comes from the public TON Center API:

• whether the account exists and its state,
• when it was first used,
• its balance (shown in the full report),
• its last 50 transactions, for patterns such as many senders in a few hours or funds forwarded onward almost immediately,
• whether recent counterparties are addresses Plumbline has flagged or that users report heavily.

Wallet checks take a few seconds because the free API is rate limited.

Community reports

Anyone with a day-old account can report a link or wallet, once per target, up to five a day. A report count is shown only after several different people report the same target, is described as unverified, and has a capped effect: reports alone can raise a verdict to Caution at most, never to Dangerous.

What the checks cannot see

• Brand-new phishing that is on no list and imitates no listed brand.
• Pages that show different content to different visitors or only after scripts run.
• Intent. A wallet with ordinary history can still belong to someone who will scam you.

Data sources: Phishing.Database (MIT licence), IANA and registry RDAP services, Cloudflare DNS over HTTPS, and TON Center. For the licence details of any source, write to joshuamhone9@gmail.com.