RelayShield Scam Checks

Checks whether an email address appears in known data breaches. Provide email. Returns the number of breaches found with the named sources behind each; a count of zero means no breaches were found in the corpus, not that the address is safe. Read-only: it only looks up breach records. Requires the RELAYSHIELD_API_KEY environment variable; without it, the tool returns setup instructions instead of calling the API.

Scores a suspicious email for phishing signals from its parsed fields. Provide any of: from_address, from_name, reply_to, return_path, subject, body_text, and links (up to 25). Returns a risk level and score with the specific flags behind them; links in the email are also checked against RelayShield's threat-intelligence corpus. A verdict of unknown means nothing conclusive was found; this tool never reports an email as safe.

Checks one URL, or up to 25 URLs in a single call, against RelayShield's threat-intelligence corpus for known phishing, malware, and scam abuse. Provide either url (a single http:// or https:// link) or urls (an array of up to 25 links). Returns a per-link verdict of FLAGGED or unknown with the reasons behind each verdict, plus counts of checked, flagged, and incomplete links. A verdict of unknown means nothing is known against the link; this tool never reports a link as safe.

Returns a read-only risk assessment of a cryptocurrency wallet address. It never moves funds or initiates transactions. Provide address; the chain (EVM, Solana, TON, or Bitcoin) is detected from the address format automatically. Returns a risk level of CRITICAL, HIGH, MEDIUM, LOW, or unknown, with the specific sanctions, scam, drainer, and phishing flags behind it. A verdict of unknown means nothing is known against the address; it does not mean the address is safe.