FlashGuard

The complete instrument

Nine consoles, one verdict

Every screen in the verifier, and everything each one reads: eight numbered consoles 01–08, and ★ One Search — the ninth console — sitting up front as the default landing, running all the others at once. 149 checks across 12 categories, from a single contract read to a full behavioral-forensics scorecard. Paste what the counterparty gave you — the app does the rest.

• ★One SearchThe default landing. One form — their address, your address, the hash, the token, the link, the amount, the network — fanned across every check at once.
  • One synthesized headline: DO NOT PROCEED · CAUTION · NO RED FLAGS
  • Per-check section cards beneath, worst finding first
  • Poison-twin diff runs only when the two addresses genuinely look alike — no false alarms
  • Allowance audit auto-runs when a specific network is chosen
• 01TransactionThe payment “proof” they sent, checked against the chain that supposedly carries it.
  • Auto-hunt across every hex rail; Tezos o… and NEAR hashes self-route
  • Did the genuine contract emit it — to your address, for the claimed amount?
  • Catches fabricated hashes (NOT FOUND), zero-value address-poisoning “sends”, misdirected and failed transfers, other-token transfers dressed as USD₮
  • Round-trip netting — credited 5,000 and pulled 5,000 back in the same tx nets to zero, never a green “received”; catches multicall, re-entrancy and 7702 clawbacks
  • Stalled-payment — a pending tx priced below the network’s base fee can never confirm; the “in-flight payment” that pays nobody, called out
  • Poison-shadow — scans the blocks around a genuine payment for planted look-alike dust seeded to hijack your copy-paste
  • Shallow confirmations → WAIT verdict; Kaia Wormhole → BRIDGED, NOT NATIVE
• 02Real balance & reputationThe number a wallet app shows versus the number the official contract holds — and who really controls that address.
  • Reads the official USD₮ contract on every rail at once — one address, full sweep
  • Tether blacklist — read straight from the USD₮ contract: has Tether frozen this address?
  • Address intelligence (GoPlus) — screened for malicious tags: sanctions, theft, phishing, mixer ties
  • Sanctions screening — the Chainalysis on-chain oracle across 6 EVM rails and TRM Labs chain-agnostic screening, so Tron and every non-EVM rail get a real OFAC check, not a blank
  • Behavioral forensics — the money-movement shape: collection-mule funnels, payout fan-out, sweep velocity, peel chains, wash loops and round-number staging, read straight off the transfer graph
  • FG-Score — an explainable risk scorecard: 17 named, weighted signals summed into 0–100 (LOW→SEVERE), every contribution printed — a score you can audit, not a black box
  • Multi-hop taint trace — a 2-hop walk of the counterparty graph, each node checked against sanctions, Tether freezes and scam blacklists — renders the full A → B → C path
  • Tron: staged-resources (rented energy, nothing self-frozen — a wallet dressed for one show) and first-funder attribution (mule networks share activators)
  • Solana: standing SPL delegate (this rail’s live allowance), frozen accounts and foreign close authority surfaced as drain exposure
  • Account permissions — is the wallet self-controlled, or do foreign signing keys hold it? The Tron “pre-loaded wallet for sale” (real balance, seller’s keys) caught before the fee is paid
  • Account dossier — age (a wallet born yesterday is a warning), transaction history, gas balance, and any public exchange identity tag
  • Counterfeit props in the wallet — tokens named like USDT (even the “USTD” transposition) that aren’t the real contract — the stage dressing of a flash-USDT con
  • Address-poisoning exposure — zero-value and dust “sends” seeding a look-alike history in your transfer list
  • Wallet or contract — is a “personal wallet” actually a smart contract? (EIP-7702 smart-accounts told apart from true contracts)
  • TON: also lists counterfeit look-alike jettons sitting in the wallet; Liquid: blinded outputs get an honest CONFIDENTIAL verdict, never a guess
• 03Token contractIs the token itself the real USD₮ — or an impostor wearing the name?
  • Registry match against every official deployment; scan one chain or all
  • Homoglyph fold: Cyrillic Т, zero-width characters, confusables — unmasked
  • Decimals & supply sanity (an 18-decimal, 100-billion “Tether” is a prop)
  • Bytecode fingerprint — runtime code hashed against the official contract; an EIP-1167 minimal-proxy shell is unmasked and its real logic named
  • Seizure primitives — Algorand ASA clawback/freeze and Solana Token-2022 permanent-delegate / transfer-hook / default-frozen: a SEIZABLE COUNTERFEIT the issuer can claw back after you accept it
  • Deprecated-rail — a real transfer of a token Tether no longer redeems (Omni, EOS, BCH-SLP…) is flagged GENUINE — DEPRECATED RAIL, not a clean pass
  • GoPlus security read (incl. fake-standard-interface), Tronscan red-tag, honeypot simulation + market reality — no tradable market means unsellable paper
• 04Links · twins · approvalsThe three quiet attacks: the fake page, the twin address, the signed-away allowance.
  • Cloned explorers (tr0nscan), punycode & subdomain look-alikes, live phishing blocklists
  • Domain age — a “trusted exchange” whose domain was registered last month is a tell no blocklist has caught yet (read live from the registry)
  • Address-poisoning twins compared character by character
  • Tron addresses put through real base58check → BAD CHECKSUM on a forgery
  • Approval drainer: asks the official contract the live allowance a QR or signature granted — anything but zero gets revoked
  • Permit2 & shared-router spenders named, with the batch-approval amplification they carry; EIP-7702 delegate audit — a wallet delegating execution has its delegate contract itself inspected
• 05Deal analyzerPaste the pitch itself — the Telegram offer, the “discounted USDT”, the guaranteed return.
  • Pattern-matched against the documented cons
  • Names the play: flash-USDT, permission trap, advance-fee, poison twin…
  • Tells you exactly which console to run next
• 06Registry & playbookThe reference room: every official contract, and every known con, side by side.
  • Official USD₮ deployment registry — live-checked rows, copy-ready, explorer-linked
  • The scam playbook: each fraud pattern explained with its tells
• 07Live ratesThe real tradable price of USD₮ around the world — where the official FX rate lies.
  • Cheapest verified venue per country, premium vs official FX called out
  • Full detail in the street price below
• 08Additional deploymentsThe long tail of official USD₮ — pinned, referenced, and probed live.
  • Algorand ASA 312769 · Polkadot Asset Hub asset 1984 · the whole USDT0 family
  • One-click live registry probes against real chain nodes
  • Supply figures labeled honestly (an asset cap is not circulation)

Beyond the balance

The intelligence layer

Most tools stop at “is this the real contract?”. FlashGuard keeps going — reading how the money actually moves, and scoring it in the open. Every signal below is computed from public nodes alone, with no key, no account and no third-party intelligence subscription. In every way, it’s not just “industry-standard” — it’s ahead of the entire league.

• FGExplainable risk score17 named, weighted signals summed into a 0–100 FG-Score (LOW · GUARDED · HIGH · SEVERE). Every contribution is printed and ranked — a scorecard you can audit line by line, not a black-box number.
• ⇄Flow-shape forensicsThe launderer’s fingerprints, read off the transfer graph: collection-mule funnels, payout fan-out, pass-through sweep velocity, receive-X-forward-X peel chains, wash-loop recycling and round-number staging.
• →→Multi-hop taint traceA 2-hop walk of the counterparty graph — every node checked against OFAC sanctions, Tether freezes and community scam lists. Renders the full A → B → C path, so a wallet two handshakes from a sanctioned address can’t hide.
• §Sanctions, every railThe Chainalysis on-chain oracle across six EVM chains, plus TRM Labs chain-agnostic screening — so Tron (where most Tether freezes happen) and every non-EVM rail get a real OFAC check, never a silent blank.
• 0xBytecode & delegate auditRuntime code fingerprinted against the official contract; EIP-1167 proxy shells unmasked; EIP-7702 wallet delegates inspected; Permit2 and shared routers named with the batch-approval reach they carry.
• ⤺Post-receipt seizureThe tokens that vanish days after you accept them: Algorand clawback/freeze and Solana Token-2022 permanent-delegate, transfer-hook and default-frozen state — flagged SEIZABLE before you part with anything.

This is the layer built for the ask “forensics no one else ships” — and it runs entirely in your browser.

Coverage

Every rail, by name

27 networks verified live against public nodes, plus one guided rail. If USD₮ officially exists there, FlashGuard reads it there.

Each rail speaks its own dialect — jetton masters, fungible-asset stores, FA2 token ids, blinded outputs, HTS mirrors — and FlashGuard speaks all of them natively.

Console 07, in full

The street price

“Cheap USDT” is the oldest bait in the con. FlashGuard shows what a dollar-token really costs, everywhere, so a fake discount has nowhere to hide.

• 41Direct venue feedsLive keyless adapters to real exchanges — Binance, OKX, Bybit, Kraken, Coinbase, Upbit, Bitso, KuCoin, Bitget, GOPAX, Foxbit, Quidax, Buda, Coins.ph, Giottus, Rain and more — each quoting USD₮ in its home fiat.
• ~1.9kAggregator sweepCoinGecko ∪ Coinpaprika tickers cross-checked in one pass, plus the live USD₮ peg itself across 42 fiats.
• 57Fiats pricedEvery covered currency gets a “what the official FX says a USD₮ should cost” truth row — the gap between that and the street is printed, not hidden.
• P2PStreet order booksWhere the real market is peer-to-peer — India ₹, Dubai AED, LatAm — FlashGuard pools live asks across desks and quotes the 20th-percentile achievable price, not a fantasy median.
• ±%Premium alertsA genuine India premium of +7% is market reality. A stranger offering −15% is not a deal — the board makes that arithmetic unarguable.
• 100%Honest coverageEvery venue not on the board says exactly why — crypto-only, bot-walled, geo-fenced, key-gated. No silent gaps, no pretend completeness.

Evidence you can hand over

The paperwork

One click turns any finished check into a letterhead audit report — for the counterparty, the bank, the lawyer, the police complaint.

• PDFAudit-grade exportAvailable on One Search and consoles 01 · 02 · 03. Sealed letterhead, unique report id (FG-YYYYMMDD-XXXXXXXX), UTC timestamp, and the full subject-parameter ledger of exactly what was checked.
• SHATamper-evidentA SHA-256 fingerprint computed from the findings themselves is printed on the report — alter one word of the evidence and the fingerprint no longer matches.
• §Methodology + noticeEvery report carries its methodology, the verdict cards as rendered, explorer URLs in print, and the legal small print as its final page.

Adversarially tested

The armor

A fraud detector is only as good as the attacks it has already survived. FlashGuard is red-teamed against its own counterfeit kit — 1,014 automated tests, all green before any release. In every way, it’s not just “industry-standard” — it’s ahead of the entire league.

• 601Engine testsEvery judge, validator and adapter pinned by automated tests — all green before any release.
• 80Red-team assertionsA hermetic adversarial suite drives the real engine with synthetic counterfeits on every rail — mutation-proven, zero false passes.
• 308Catalog-integrity checksEvery one of the 149 published checks is bound to a line of shipped code. A claimed check that isn’t really implemented fails the build — no vapor features, ever.
• 27Counterfeit-lab scenariosA live demo harness that replays whole cons — fake tokens, fabricated proofs, permission traps, cloned explorers — against the actual app, and narrates each catch.
• ₮≠TUnicode unmaskingNFKC normalization, invisible-character stripping and confusable folding — a Cyrillic-Т “USDT” reads as the counterfeit it is.
• ✓58Real checksumsTron addresses verified with genuine base58check (double-SHA-256), not a shape regex — one wrong character is a BAD CHECKSUM, never a lookup.
• { }Hardened internalsPrototype-pollution guards on every registry lookup — even the string “constructor” can’t forge a genuine verdict.

Privacy by architecture

What it never asks

• 0Seed phrases · keysNever requested, nowhere to enter one. Public addresses and hashes only — anyone who asks for your seed phrase is the scam.
• 0Accounts · uploadsThe verifier needs no sign-up and stores nothing of yours. Your queries go straight from your device to public blockchain nodes.
• 1File, self-containedThe whole web app is a single offline-capable file — no build, no trackers, no third-party scripts. Open it from a USB stick if you like.

The wider system

Beyond this tab

• 📱Android & iOSThe full engine as a native mobile app — One Search first, camera-only QR scanning, every console mirrored, audit PDFs shared straight from the phone.
• APIFor machines & AI agentsSix REST endpoints (token · transaction · balance · link · allowance · twin) with normalized verdicts, an OpenAPI 3.1 spec, developer docs, and a zero-dependency MCP server so Claude or any agent can verify USD₮ mid-conversation.
• 🔑The licensed deskThe live-rates feed as a paid seat: personal access codes, one live session per code with clone detection, customer portal with API keys and usage, referral codes for the sales network.
• HQAdmin consoleWho’s online in real time, sign-up approvals, seat kick/revoke/history, customer creation, product analytics — the whole operation on one screen.

Deployed live at 1usdt.duckdns.org — the same build you can open from this page.

Work with us

Three ways to build this with us

FlashGuard is sold by people, powered by an API, and grown by partners. Pick your door — and let’s discuss.

Inquiry

Tell us who you are

For any inquiry, write to arpitgupta3@proton.me — or use the form below; it lands on our desk instantly.