Methodology

Every heuristic finding in a Leeri verdict links to one of the rules below: what the rule detects and exactly when it fires.

• Account control delegated to a foreign key — The owner permission is configured so a key outside this address can fully control the account.
• Foreign co-signer on owner permission — A multisig-style owner permission includes one or more keys that do not belong to this address.
• Foreign key can move funds — A spending-capable active permission (transfer, freeze, delegate and similar operations) can be exercised by foreign keys alone.
• Foreign co-signer on a spending permission — A spending-capable active permission includes a foreign key as one signer among several, without that key alone controlling it.
• Foreign key on a non-spending permission — A foreign key is present on a permission that carries no value-moving operations.
• Multisig configuration — This address is configured with more than one signing key on at least one permission.
• First-time-holder USDT dispersal — A pattern of outbound TRC-20 USDT transfers that overwhelmingly create brand-new balances rather than pay addresses that already hold USDT.
• Layered / pass-through inbound funds — A meaningful share of this address's inbound value arrived via addresses that immediately forwarded almost everything they ever received.
• Address poisoning — Dust transfers from lookalike addresses crafted to resemble a real payee this wallet has genuinely paid before.
• Wallet impersonation — Addresses that mimic this wallet's own trailing characters, aimed at whoever pays it from memory or copied history rather than at this wallet directly.
• Counterfeit USDT — Tokens that present themselves as USDT but are not issued by Tether's real contract.
• Counterfeit stablecoin contract — A token contract whose own name or symbol imitates USDT or USDC and that is neither the issuer's contract nor a listed legitimate one on that chain. It is priced as a scam designation of the contract.
• Pass-through wallet pattern — An address behaving as a transit point rather than a holding wallet — funds arrive and leave quickly with little balance retained.
• Balance reconciliation mismatch — A discrepancy between the balance implied by observed transfer history and the balance the chain itself reports for this address.
• Unsolicited TRC-10 tokens — Many TRC-10 tokens that the address never asked for, typical of an address harvested by mass-distribution bots.
• Risky transactions — Transactions in this address's recent history that a public TRON block explorer marks as risky, most of them dust or unsolicited tokens sent by other addresses.
• Blacklisted by Tether — The address itself is frozen in the USDT contract's blacklist.
• Contract on the Tether blacklist — The checked address is a smart contract that sits on the USDT blacklist.
• Public risk label — The address carries a public risk label on a TRON block explorer.