Suspicious Token Behavior Analyzer

WHAT IT DOES

Suspicious Token Behavior Analyzer reads live on-chain data from any EVM token contract and uses AI to detect scam patterns, malicious mechanics, and high-risk behaviors. It examines token bytecode for selfdestruct operations, hidden owner minting functions, fee-on-transfer mechanics, rebase manipulations, unlimited approval patterns, and blacklist/whitelist controls. It scans transfer event logs to analyze holder distribution and concentration risk. It checks owner/renounce ownership status, trading pause functions, max transaction or wallet limits, and proxy upgrade patterns. It also reads liquidity pool balances and approval allowances to detect potential rug-pull setups. The AI generates a plain-language risk assessment explaining exactly what risks exist for anyone holding or trading this token, with a clear risk level label.

HOW TO USE

Paste any EVM token contract address into the input field. The tool reads the token's bytecode and decodes function signatures to identify known malicious patterns. It then fetches transfer event logs across recent blocks to build a holder distribution map, showing token concentration and potential whale control. It checks the token's owner status, total supply, and any available metadata like name, symbol, and decimals. The AI receives all this data and returns a structured risk assessment labeled HIGH, MEDIUM, or LOW, along with a plain explanation of the suspicious behaviors detected. The wallet connection is optional but recommended for reading live data from your current network. You can also switch networks manually to analyze tokens deployed on different EVM chains.

CHUNKED LOG SCANNING WITH AUTOMATIC BACKOFF

The tool fetches transfer event logs to build holder distribution maps. Public RPC endpoints enforce varying block range limits per request—some allow 10,000 blocks, others only 2,000, and some reject requests that span more than a few hundred blocks. This tool automatically detects the per-request range limit by probing and adjusts batch sizes accordingly. It walks backwards from the current block in chunks and, if a request fails due to a range limit, it halves the chunk size and retries. If a request fails due to rate limiting, it backs off exponentially and resumes from the last successfully scanned block. This ensures that even on heavily rate-limited public nodes, the tool completes a holder scan without giving up on the first refusal. The scan is capped to the most recent 200,000 blocks to balance completeness against performance; older tokens may show partial holder data, but the most active holders are still captured.

WHAT IT CANNOT SEE

This tool cannot detect off-chain token scams, social media impersonation, or phishing links that direct users to fake websites. It cannot analyze bytecode that is obfuscated beyond EVM disassembly limits—some contracts use anti-analysis techniques to hide their true behavior. It cannot verify token source code match against third-party verification services like Etherscan; it only reads the deployed bytecode directly from the chain. It cannot detect malicious intent in upgradeable proxy patterns beyond reading the current implementation—a proxy could be upgraded to a malicious implementation later, and this tool only shows the current state at the time of analysis. It cannot see pending transactions not yet included in the mempool. It cannot determine if a token's off-chain metadata, website, or social presence is fraudulent. It cannot detect tokens that are not yet deployed or that have no bytecode at the provided address.

PLEASE NOTE

EVM chains only. This tool reads on-chain data and generates AI explanations—it does NOT sign transactions or execute any on-chain actions. The wallet's own signature prompt remains the final gate for every real action. Always review the exact transaction details in your wallet before approving any signature or token interaction. The AI assessment is informational only and does not constitute financial or security advice. Always verify token contract addresses against official project documentation before interacting with any token.