How lookalikes are found
Address poisoning: someone makes an address that starts and ends like one you pay, then sends you a tiny amount from it, so it sits in your history next to the real one. Wallets shorten addresses to their ends, so the copy looks right. If you later copy the address from your history instead of from where it came from, you pay the lookalike.
The rule, in full
A check reads the wallet's last 300 successful transactions and counts a lookalike attempt when all four hold:
- You did not sign it. Someone else's transaction sent you SOL or a token, or put its address in your history.
- The sender is not someone you had paid. It is not the wallet itself, and the wallet had not sent it SOL or a token in the window before this transfer.
- It looks like an address you paid (or like the wallet itself), comparing characters in their exact case:
- the same first 3 or more characters and the same last 3 or more, or
- at least 5 characters in all, at least 1 at each end (4 + 1, 3 + 2, 2 + 3…), arriving within 24 hours after you paid the address it copies. That timing is how most lookalikes arrive: seconds to minutes after a real payment.
- What it sent is dust: nothing, under 0.001 SOL, under 0.001 of a token, or a token the wallet never traded in the window (fake tokens named like real ones fall here).
A transfer from a lookalike that sent more than that is listed under the result but not counted.
Why these numbers: by chance alone, two random Solana addresses share their first 3 and last 3 characters about once in tens of billions of pairs, so a match like that is made on purpose. Making one costs the sender computing time for every extra character, which is why many lookalikes copy only 4 + 1 or 3 + 2 characters; those count only when they arrive soon after a real payment.
You paid a lookalike
When two addresses you paid share their first 3 and last 3 characters, or the later one first sent you dust and shares 5 or more characters with the earlier one, the result says so at the top. It cannot tell which payment was meant: you can.
What a check reads
- The wallet's last 300 successful transactions, newest first, read from a Solana RPC node: the transactions that name the wallet and those that change a balance in one of its token accounts. The result says how far back that reaches; a wallet that gets a lot of dust reaches back only days.
- A wallet is read again after 24 hours. Within that time the same answer is shown, and "Re-check now" re-reads it once it is an hour old.
- "New attempts since your last check" compares with what this browser saw last time (wallets you checked are kept in this browser only, and you can forget them).
What a check misses
- Anything older than the 300 transactions, and lookalikes of addresses you paid only before that window.
- A zero-amount token transfer into a token account you already had: it changes no balance, so it is not in the history this check reads.
- Lookalikes that copy fewer characters than the rule above, and lookalikes of addresses that paid you (only addresses you paid are compared).
- Who sent them. Poisoned names no one and keeps no list of senders.
- It blocks nothing. Before you send: check the whole address, not its ends, and keep the addresses you pay in your wallet's address book.
The drill
- 10 rounds, the same for everyone on a UTC day. An address shows for 2 seconds; then four addresses that start and end like it. Pick the real one.
- Rounds 1 to 4 copy the first 4 and last 4 characters (like most lookalikes); rounds 5 to 7 copy 6 and 6; rounds 8 to 10 copy everything but one run of 6 characters in the middle.
- Your time is the sum of your answer times (the 2-second showings are not counted); a round left unanswered for 15 seconds counts as wrong. The page measures it, so the ranking is a friendly one: more right answers first, then faster, and 10 rounds in under 4 seconds are not ranked. Your first finished drill of the day counts; replays are practice.
- Every address in the drill is a generated string, never a real wallet.
What is kept
| What | Where, for how long |
|---|---|
| The address you check | Sent to the server and to the RPC node that reads its history. The answer is cached for up to 24 hours so a re-check costs nothing. Not written to any database. |
A share card (/x/…) | Counts only: attempts, addresses imitated, the latest date, how many transactions were read, your drill score if you add it. No address. |
| Today's totals | Each wallet checked today as a hash salted with a key that is deleted after the day, with its count of attempts, so a wallet counts once a day. |
| Drill results | Score, time and streak under a random id this browser made. |
| Visits | Counts of checks, drills and card views per day, per referring site, and once per visitor per day using a hash of the IP address salted with a key that is deleted after the day. Never the IP address itself. |
| This browser | The wallets you checked (to show what is new), your best drill and streak. Clear them any time. |
Limits
New checks are limited per visitor per hour and per day for everyone. When the day's new checks are used up, wallets already checked today and every shared link still open, and new checks resume at 00:00 UTC.