How we score addresses
We read every x402 / EIP-3009 USDC transfer on Base and describe an address by its own behavior. No opinions, no manual whitelists beyond labeled incidents, no black box: every flag comes with the reason it fired. We publish the principles, not the thresholds — the exact numbers stay private so they cannot be gamed.
The eight signals
- New address — recently seen for the first time. A short history gives us little to judge by, and fresh addresses are cheap to create.
- Thin history — very few incoming payments and little volume: not enough evidence in either direction.
- Concentration — most deals are with a single counterparty, a pattern consistent with self-dealing or manufactured activity.
- One-off pattern — almost every counterparty paid exactly once and never came back: consistent with "take the money and disappear".
- Linked to flagged — direct or one-hop transfers with an address we labeled as a scam. Dust-sized transfers are ignored, so nobody can taint an address by sending it a cent.
- Sybil suspect — first funded by the same source as a group of sibling addresses created around the same time. Known limit: we cannot see gas funding, so we use the first USDC funding as a proxy.
- Activity spike — recent activity far above the address's own baseline.
- Labeled — a human reviewer has labeled the address (scam confirmed, scam suspected, or trusted). Labels override heuristics.
An address with no history at all is not an error: we return a neutral, low-confidence answer and say so.
How sure we are about the data
The x402 protocol has no canonical on-chain marker. We classify a transfer as confirmed when it settles through a facilitator we track, and probable when it matches the payment pattern without one. Every answer states which basis it used. We would rather show you the uncertainty than hide it.
Labels and corrections
Labels are added by hand from incident reports and public sources. If you believe a flag on your address is wrong, write to us: a human reviews it, and if we were wrong we fix the label and the score changes on the next run.
Changelog
| Version | Date | Change |
|---|---|---|
v1.0 | 2026-08-10 | First published. Eight v0 signals, no machine learning; thresholds calibrated on the full Base backfill. |
Risk signals, not accusations. A low score means we saw patterns worth checking — not proof of fraud. We explain every flag, and we fix mistakes: if you think a flag is wrong, write to us and a human will review it.