// dust & address-poisoning detector

The address in your history may not be the one you paid.

Mainnet live · checking… Status: Ticker (placeholder, no token exists):
// the working app

Scan a wallet for dust and lookalikes

Paste a public Solana address. Dustveil reads its latest signatures and transactions from mainnet, learns which addresses it actually paid, then checks every incoming transfer: is it dust, and does the sender imitate someone you paid?

Scan settings

Reads are capped so the public RPC stays usable. Everything runs in this page.

Waiting for an address.

Compare two addresses

Before you send: paste the address you are about to use and the one you know is right (from the recipient, not from history). Runs locally — nothing is sent anywhere.

Findings

Results come from real mainnet reads and are heuristics, not proof.

—txs analysed
—incoming transfers
—addresses you paid
—dust deposits
—lookalike senders
—paid a lookalike?
No scan yet.
Other dust (no lookalike match)
—
Addresses this wallet paid (the reference set)
—
// how it works

How the poisoning trick works — and how this page catches it

  1. The trick. You pay someone. A bot watching the chain grinds a vanity address with the same first and last characters as your recipient, then sends you a tiny amount (or a zero-value token transfer) from it. Now the fake sits at the top of your history. Next time you copy "the usual address" from history, you copy the fake.
  2. Read. Dustveil calls getSignaturesForAddress for your address (and, optionally, your USDC/USDT token accounts), then getTransaction (jsonParsed) for up to the cap you picked, two at a time with back-off on rate limits.
  3. Parse. It extracts System Program SOL transfers and SPL Token / Token-2022 transfer, transferChecked and transferCheckedWithFee — including inner (CPI) instructions — and resolves token accounts to their owners from the transaction's token-balance metadata. Failed transactions are ignored.
  4. Reference set. Every address your wallet sent funds to, plus anything you typed in, is treated as "someone you really pay".
  5. Flag. Each incoming sender is compared with the reference set: same first 4 and last 4 characters but a different address = lookalike. Weaker partial matches (3+3 or 5 on one side) are shown separately. Tiny SOL (below your threshold), zero-value token transfers and sub-cent token amounts are flagged as dust. If your wallet later sent funds to a lookalike, that's marked critical.
Never copy from history.Treat your transaction list as untrusted. Take addresses from the recipient directly, or from an address book you saved once and checked.
Check the middle.Poisoners match the ends because that's what people glance at. Compare the whole string — the comparer above lights up every differing character.
Ignore the dust.Don't send it back, don't "clean it up" by sweeping it. Interacting with dust can tie your wallet to the sender's cluster for anyone watching.
// privacy model

Dust is also a tracking tag

Unsolicited dust isn't only phishing bait. It lets the sender tag your wallet and watch what you do with it — if you later move that dust together with other funds, you've linked those funds for them.

What Dustveil keeps private

  • Your lookup: no account, no cookies for tracking, and the server keeps no record of which address you scanned — it only relays allowlisted read calls
  • Your "addresses you really use" list: it stays in this tab and is never sent anywhere (only the scanned wallet's own history is read)
  • Results: computed in your browser, never uploaded

What still leaks

  • Everything on-chain is public: anyone can run the same reads and see your counterparties, the dust and the lookalikes
  • The RPC operator (this site's proxy and the upstream mainnet RPC) sees your IP, the time and which address/signatures were requested
  • Explorer links open a third-party site that sees what you click
  • Dustveil cannot remove dust or protect a wallet — it only shows you what's there

Dustveil reduces your exposure to a common scam and explains a tracking technique. It does not make you anonymous.

Known limitations — please read

  • It only sees the recent window. At most 100 signatures and 40 transactions are read. Older poisoning attempts, and payments you made outside that window, aren't in the reference set. The page always says exactly how many transactions were analysed.
  • Token transfers can hide under token accounts. An incoming token transfer touches your token account, not your wallet, so it may not appear in your wallet's signature list. The USDC/USDT option covers those two; other tokens may be missed.
  • Heuristics, not proof. A lookalike match is extremely unlikely by chance, but a "dust" deposit can be an innocent airdrop or a refund, and a sophisticated attacker can match more characters than four.
  • No labels. Dustveil doesn't know who owns any address and never guesses names. "You paid" only means this wallet sent funds there in the analysed window.
  • Public RPC limits. Reads go through a free public endpoint by default and may be slow or rate-limited; some transactions may fail to load and are reported as skipped.
  • Experimental and unaudited. Hand-written; verify anything important in a block explorer.