How It Works

Six steps to verify any API endpoint

Connect & Probe

We connect to the API endpoint, check DNS resolution, TLS certificates, and HTTP headers to establish a baseline profile.

Model Identification

We query the /v1/models endpoint and analyze error responses to determine the provider family (GPT, Claude, GLM, etc.) without needing an API key.

Relay Detection

We cross-reference the IP address, ASN, and domain against our official provider whitelist to detect relays, proxies, and unauthorized resellers.

Behavioral Fingerprint

With an API key, we send carefully crafted probes — including rare token analysis from UTF research — to verify the actual model behind the endpoint.

Token Audit

We compare reported token counts against our own estimates to detect inflation (charging for more tokens than used) and hidden system prompts.

Trust Score

All checks are aggregated into a Trust Score (L0-L7) and letter grade (A/B/C/D), giving you a clear verdict at a glance.

Trust Levels

L0Unreachable— Endpoint could not be reached

L1Connected— Basic connectivity established

L2Protocol OK— TLS and headers verified

L3Identified— Provider family identified

L4Verified Relay— Known legitimate relay confirmed

L5Official Confirmed— Official API domain and ASN match

L6Fingerprinted— Behavioral fingerprint verified

L7Fully Verified— All checks including token audit passed

Why Trust Us

🔬

Scientific Method

Based on academic research including UTF rare token probing and behavioral fingerprinting from LLMmap.

🔑

No Key Required

Quick Scan works without any API key. We only need an endpoint URL to start.

🔒

Privacy First

API keys are never stored. Deep scan results stay in your browser localStorage.

📊

80+ Model Database

Covers 16+ model families with tokenizer ratios, identity patterns, and refusal signatures.

FAQ

What is API fraud?

API fraud includes: fake models (claiming GPT-4 but serving GPT-3.5), token inflation (charging for more tokens than used), relay chains (your data passes through unknown intermediaries), and speed reduction (throttling responses while charging full price).

How accurate is the detection?

Quick Scan provides family-level identification with ~70% confidence for official APIs. Deep Scan with an API key achieves model-level identification with 85-99% confidence using behavioral fingerprinting and rare token probes.

Is my API key safe?

Yes. Your API key is only used during the scan and is never stored on our servers. It is cleared from memory immediately after the scan completes.

What is Trust Score L0-L7?

A graduated verification system. L0 = unreachable, L3 = provider identified, L5 = official confirmed, L7 = fully verified including token audit. Higher levels require deeper probing.

Can relay stations fake the detection?

Sophisticated relays can partially spoof responses. Our behavioral fingerprinting and rare token probes are designed to detect such spoofing, but no system is 100% foolproof. Scores are for risk flagging, not forensic evidence.