[ Threat monitoring ]

Unusual is worth a look.Every rule in plain sight.

Add wallets and contracts you care about. Wallets are checked against nine rules with thresholds you can change; contracts are watched for upgrades, owner changes, pauses, role grants and mints.

LimitsRules run in your browser on the latest 100 transactions and 100 token transfers while a page is open. A hit is a pattern, not proof; a quiet list is not proof that nothing happened.

Watch an address

Wallets get the nine rules below. Contracts get their admin events (upgrade, owner, pause, roles, mints). Up to 20, kept in this browser only.

Watched (0)

Read every 2 minutes while this tab is visible. Nothing runs when the site is closed; hosted alerts are planned.

Nothing watched yet. Add your own wallet, a wallet you fund, or a contract you depend on.

Latest hits

All alerts

No rule hit in what was read. That is not proof that nothing happened.

Rules and thresholds

Saved in this browser. A hit is a pattern worth a look, not proof of an attack.

Large HYPE out (HYPE)Burst: transactionsBurst: within minutesSweep: different tokensSweep: within minutesFailed in a rowNew counterparty: last hours

highUnlimited approval granted. An outgoing approve() or increaseAllowance() whose amount is 2^255 or more.
highCollection operator granted. An outgoing setApprovalForAll(operator, true).
cautionLarge HYPE transfer out. One outgoing transaction carrying 100 HYPE or more.
infoNew counterparty. An outgoing transaction in the last 24 h to an address this wallet never sent to earlier in the fetched history (needs at least 20 older transactions).
cautionBurst of transactions. 10 or more outgoing transactions within 10 minutes.
cautionFailed transactions in a row. 3 or more consecutive failed outgoing transactions.
highMany tokens sent out quickly. 3 or more different tokens sent out within 30 minutes (a pattern of drainer scripts).
cautionCalled a reported contract. An outgoing transaction to a contract with an open or upheld report on the report ledger.
cautionLook-alike sender (address poisoning). An incoming token transfer of 0 from an address whose first 4 and last 4 hex characters match an address this wallet sent to, but which is a different address.

History window: the latest 100 transactions and 100 token transfers per wallet, from the Elysium explorer.