Over the past two years the TON ecosystem has accumulated enough scam patterns for a dedicated security infrastructure to form around them. One of the key pieces is Re:Doubt (re-doubt.com) — a platform from the Tonkeeper team that maintains a public database of scam contracts, drainer wallets and impersonation jettons. This guide is a practical walkthrough: how to use Re:Doubt for your own checks, what its security score really means, how it is wired into Tonkeeper, and where it stops being enough.
TL;DR
- Re:Doubt is a security-research platform from the Tonkeeper team: a public database of contracts and wallets with risk categories.
- Every address gets a category, from “no signals” to “confirmed drainer / scam / impersonation”.
- Tonkeeper uses the database to pop auto-warnings on the signing screen.
- Re:Doubt does not cover fresh contracts in their first hours — Tonviewer and manual analysis fill that gap.
- The checklist at the end is what I run before approving any non-trivial TON transaction.
What Re:Doubt is and who builds it
Re:Doubt is a public security-research service from the Tonkeeper team — the same group that ships one of the most popular non-custodial TON wallets. This context matters: Re:Doubt’s verdicts are the position of one independent team with heavy product exposure to scam victims, not an “official network verdict”.
What the platform provides:
- Contract and wallet cards with a risk category and a reason.
- A database of known drainer wallets — addresses that aggregate stolen assets.
- A database of clones and impersonation jettons that imitate popular tokens (USDT, NOT, DOGS).
- A public API, used by Tonkeeper and accessible to other dApps.
- Incident reports on major attacks — vectors, drainer campaigns, large losses.
The goal is to reduce the success rate of TON scams by flagging suspicious contracts before a user taps “confirm”.
Security score: how to read a contract or wallet rating
Every address page in Re:Doubt shows a risk assessment. It is not a numeric 0-100 score but a category with explanation. To avoid making up numbers I have not actually seen in their docs, here is the categorical picture:
- Clean / no signals — the system has nothing negative on file. Does not mean “safe”, means “no reason to flag”.
- Low risk — young contract, thin history, or weak indirect signals.
- Moderate risk — reports or suspicious patterns: cookie-cutter drainer template, unnatural transaction history.
- High risk / drainer / scam — confirmed malicious contract. Often tagged with a campaign name or citing an incident.
- Impersonation — a contract that masquerades as a known one (jetton with USDT-like ticker that is not Tether).
Each category is paired with a reason: “address appears in N complaints”, “contract is a copy of a known drainer template”, “jetton minter imitates ticker X”. This is critical: read the reason, not just the colour of the label.
!A score is not an audit
The security score says “the system has / does not have signals”. It is not a code audit and not a mathematical guarantee. A fresh contract with no complaints will read “clean” even if it was deployed 10 minutes ago with malicious logic.
Tonkeeper integration — live warnings at signing time
The most useful part of Re:Doubt is its deep integration into Tonkeeper. When you sign a transaction, the wallet pings the Re:Doubt API in the background for the counterparty and contract addresses. If a negative signal comes back, Tonkeeper renders a yellow or red banner on the confirmation screen:
- “This address is flagged as a drainer” — red, with a hard recommendation to cancel.
- “This contract looks like impersonation of a known token” — yellow, requires a conscious “continue anyway”.
- “This jetton is not verified” — soft warning to keep users from confusing a clone with real USDT.
The scenario this is designed for: you receive a “free” jetton with instructions to visit a site and “activate” it — a classic drainer flow. You tap confirm on autopilot, and right then Tonkeeper throws up the red Re:Doubt screen. This genuinely saves a lot of people, because the whole attack is built around mindless tapping.
Other TON wallets are gradually adding similar integrations, but in Tonkeeper it works out of the box.
Case walkthrough: a suspicious jetton airdrop
Let us work through a concrete flow. A wallet receives a “free” jetton with ticker USDT-AIR and amount 5000. The metadata contains a link to an “activation” site. A forensic-friendly user does the following:
Step 1 — Re:Doubt on the jetton minter.
Copy the minter contract address from the jetton card in Tonkeeper, paste into Re:Doubt search. You will likely see category impersonation or scam — Re:Doubt already knows about these tokens. If the category is “no signals” but the ticker mimics a known one, that is already a red flag by itself.
Step 2 — check the sender address.
Whoever sent the airdrop is typically a drainer distributor. Their address goes into Re:Doubt as well. Such addresses are often already on file with a label.
Step 3 — Tonviewer for the fanout.
Open Tonviewer and look at who else received the same jetton from this sender. A fan of thousands of identical messages dispatched in a minute is not a “personal gift” — it is a mass drainer distribution.
Step 4 — do NOT visit the activation site.
That is the drainer page. It will ask you to connect a wallet and sign an “activation”, which is in reality an approve that drains your real assets. Detailed breakdown in the drainer sites guide.
Step 5 — leave the jetton in the wallet.
Just holding a scam jetton is not dangerous. What is dangerous is interacting with it (approve, transfer, swap). If you ignore it, it sits as dead weight.
What Re:Doubt does not cover
To use the tool honestly you need to understand its boundaries:
- Fresh contracts. A drainer contract deployed two hours ago will have no data yet. The label will read “no signals” — which does not mean “safe”.
- UI-level attacks rather than contract-level ones. If a victim is tricked via a fake Telegram bot that generates a link with a swapped address, Re:Doubt does not help — the destination contract can be perfectly legitimate (e.g. your own wallet, just not the one you meant).
- Complex DeFi exploits. Re:Doubt is not an audit. If a DEX contract has a logic bug in its oracle, the score will not catch it.
- Social engineering. Re:Doubt does not know that a Telegram chat partner talked you into sending funds to “a friend”.
- NFT and dApp coverage is weaker than for jettons and wallets — the historical focus was on tokens and addresses.
So Re:Doubt is a first filter, not the final verdict.
Adjacent tools: Tonviewer graph, on-chain clustering, manual TonScan
For a serious investigation Re:Doubt alone is not enough. What else to keep in the toolbox:
Tonviewer (tonviewer.com). Renders the message tree of a transaction and a readable graph of relations. If a victim is trying to trace where their funds ended up, Tonviewer walks the chain through several hops quickly. Comparison with TonScan in a dedicated article.
On-chain clustering. Attempts to figure out that N distinct addresses actually belong to one operator. Useful for sizing a drainer campaign.
TonScan (tonscan.org). The classic explorer, good for manual review of individual transactions. No built-in security score, but full raw data. The basics of reading TonScan are in the transactions guide.
toncenter / tonweb CLI. For those who write their own analysis — the official API and SDK let you pull data in bulk and compute anything.
Reading on-chain metrics. For network-health context and macro signals, see the on-chain metrics guide.
Pre-approve checklist for any TON transaction
This is what I run through mentally before tapping “confirm” on any amount I would regret losing:
- Did I initiate this operation? If the wallet popped a request on its own — already a bad sign.
- Is the recipient address verified byte-by-byte? Not “first and last characters match” — fully.
- What does Re:Doubt say about the contract and recipient? Red or yellow — stop.
- Are the amount and jetton what I expect? Not “1.0 TON” instead of “0.1 TON” because of a swapped field.
- Is the contract verified? Known DEXes and dApps have verification badges.
- Do I understand exactly what I am signing? Approve, transfer, mint — these are very different operations with very different consequences.
- Is the site open at the correct URL? No Unicode lookalikes or typo-squat domains.
- If it is “free” — where is the catch? “Activate and receive N USDT” equals drainer in 99% of cases.
Going through this takes under 30 seconds but closes 90% of typical attacks.
iExtra mode for large amounts
For meaningful sums — say more than $1000 in TON or jettons — I add one more step: a test transfer of 0.5 TON to the destination address, wait for confirmation on the receiving side, and only then send the real transaction. An extra 0.005 TON in gas is cheap insurance against address swaps.
Closing thoughts
Re:Doubt is not “antivirus for TON” — it is a public signal database that major wallets rely on. It is good at catching already-known scams and significantly reduces the success of mass drainer campaigns. But fresh contracts, subtle UI-level attacks and social engineering are out of scope. The realistic posture for an active TON user is a combination: Re:Doubt plus Tonviewer plus common sense plus a checklist.
If you suspect you were targeted, dig into the typical schemes in the top-10 TON scams on Telegram and how drainer sites work.
Open Re:Doubt
Public database of scam contracts, drainer wallets and impersonation tokens on TON. Free search by address. Built by the Tonkeeper team.
→
