A safety score is not a safety check: what I learned from 31 public AirdropBuzz risk reports

The highest score in the public archive is 80/100 — for solana.com. The lowest is 24 — for t.me and memebitcoin.org. Neither number means what a busy reader might assume, and that is the most useful thing about the archive.

Disclosure: this article is an entry in the AirdropBuzz Creator Campaign. Creating content does not guarantee a reward. I am not affiliated with AirdropBuzz beyond this entry. I did not connect a wallet, sign anything, or deposit funds while doing this analysis. I am not calling any project listed here a scam; I did not audit them.

Every "is this airdrop safe?" tool faces the same problem. It has to say something useful about a page it has never seen, in seconds, without a wallet connection and without on-chain data. AirdropBuzz's checker solves that by fetching the page and scoring what it finds. The site publishes the results in a public archive: 31 recent reports, each with a 0–100 risk score, a Low/Medium/High band, and lists of red flags and positive signals.

I pulled all 31 reports on 11 November 2026 and read every field. Then I re-requested each domain from a clean client to see what was still there. The goal was not to decide which projects are legitimate. It was narrower: what does the number actually measure, and what can you safely conclude from it?

Method, so you can repeat or refute it

• Source: the public AI Risk Reports archive at airdropbuzz.com/tools/ai-airdrop-risk-reports/, 31 reports, scan dates from 12 September to 10 November 2026. The archive is visible to a logged-out visitor.
• Recorded per report: domain, score, band, scan date, every red flag, and every positive signal.
• Independent check: I requested each domain over HTTPS with no cookies, no wallet extension, and normal redirects, then recorded the status code. I did not scan anything myself and did not interact with any contract.
• Scope: this is an analysis of how a heuristic scores pages. It is not an audit of the projects, tokens, or teams behind those pages.

Finding one: the archive is small, and the middle is crowded

The 31 scores run from 24 to 80, with a median of 41 and a mean of 42.3. The bands split 6 Low, 22 Medium, 3 High.

The distribution matters more than the summary:

Twelve of 31 reports sit between 40 and 49 — a ten-point range that holds nearly 40% of the archive. A 42 and a 47 are not meaningfully different; they are two pages with roughly the same amount of risky-sounding text. The score separates the cleanest pages from the noisiest ones. It does not rank the middle, and it was never designed to. Treat it as a sorting aid, not a precision verdict.

One calibration detail worth keeping in mind: the six lowest reports score 24 to 28, and they are the pages with either no flags at all or only a referral-mechanics note. The scale's floor is not zero. A page the scanner found almost nothing to say about still starts in the mid-20s, so a 35 is not "35% risk"; it is a handful of points above a page with no substantive flags. The number is relative to this scale, not a probability.

Finding two: the score reads the page's vocabulary

The most common flag is not a finding about a project. It is a phrase match:

The page appears to mention deposits, trading, bridging, staking, or funding actions. Review capital risk before participating.

17 of the 31 reports carry that exact line. The second most common is referral or leaderboard mechanics, 10 of 31. Seven reports say "No critical red flags were detected from the visible page signals" — two of those still land in Medium at 35, while the other five sit at the bottom of Low (24–28).

That is not a flaw in the tool; it is how a text scanner has to work. It cannot tell whether "stake" appears in a product description, a documentation page, or a demand for money. It can only see the word. The useful move is to read the flag as a question — where exactly does this page ask for money? — rather than as a conclusion about the project.

Finding three: the highest score in the archive is an official chain site

The single highest score is solana.com at 80/100, High, scanned 14 October 2026. The flags:

• the page mentions seed phrases, private keys, or recovery phrases;
• the page involves wallet connection, signatures, or token approvals;
• the page mentions deposits, trading, bridging, staking, or funding.

Those are all true statements about Solana's website. It documents wallets, staking, and security — including pages that warn people never to share a seed phrase. The scanner is doing exactly what it says: detecting the vocabulary of wallet risk, wherever that vocabulary appears. A tutorial that warns about seed phrases trips the same rule as a page that asks for one.

Two disposable Cloudflare quick-tunnel pages scanned on 10 November tell the other side of the story. Both use random-word subdomains of trycloudflare.com — the kind of throwaway URL anyone can spin up in a minute — and both scored 35/100, Medium, with "no critical red flags". But app.allox.ai, loqua.net and mine.scalenetwork.org show the same visible pair — HTTPS present, page reachable — plus no critical flags, and all three score 28/100, Low. The public report does not expose what accounts for the seven-point gap. Whatever it is, it is not a difference a reader can see and verify.

This site's own domain, airdropbuzz.com, was scanned on 4 November and scored 62/100, High — flagged for deposit/trading/staking language, high-pressure reward language, and referral mechanics. It is a website that writes about airdrops. The words are the content.

Put those three together and the lesson is clear: a 35 can be a disposable shell, and an 80 can be the official Solana site. The number is not a trust ranking. It measures how much risky-sounding language a page contains, plus a handful of missing-signal checks — not whether the thing behind the page is honest.

Finding four: "Medium" is three different results wearing one label

Twenty-two reports are Medium. Inside that band:

• most carry specific flags (deposit language, referral mechanics, pressure wording);
• 4 say the page could not be fetched reliably;
• 3 of those 4 add the line: "Insufficient evidence: no reliable successful page response was available. This result is not a safety clearance."

The sharpest example is claim-worldcoin.live: 62/100, High — the joint second-highest score in the archive — on a scan that says "The website returned an error page during the scan, so the project page could not be fully reviewed." The score reflects a failed scan, not a reviewed project.

So "Medium" can mean we saw some risky words, we could not see the page, or we saw nothing at all. Those are completely different states. If a page blocks the scanner, the resulting score is not a judgement about the site; it is a statement about the scan. The report says as much, but the band alone does not.

Finding five: every report in the archive is a fallback scan

Each of the 31 report pages carries the same sentence: the scan is a fallback safety scan active because the external AI agent was unavailable, and the result should be treated as a practical risk snapshot rather than a full investigation.

That disclosure is the correct frame for every number above. A rules-based first pass is genuinely useful, but it is a first pass. It reads words, checks HTTPS, and tries to fetch the page. Nothing in the report says who registered the domain, whether the team exists, or what the claim contract will do when you sign.

Finding six: links rot, and the scan is a photograph

When I re-requested all 31 domains on 11 November, 23 returned HTTP 200, 4 blocked the request (403 or 429 — usually bot protection rather than a verdict), and 4 did not resolve at all. All four dead domains come from the two obvious disposable families: both trycloudflare.com quick tunnels and both claim-free-airdrop-…xyz names.

One more detail from the same check: airdrop-pendle.finance, a hyphenated domain built around a well-known project's name, now resolves to a parking page that says the domain may be for sale. The scan was dated 14 October. By 11 November, the page it described was gone.

That is the point of a disposable page: it does not need to survive. A scan is a photograph of a page at one moment. Last week's clean page can be replaced tomorrow, and last week's dangerous URL can be dead before anyone clicks it. An archive is a record, not a guarantee.

What the score can and cannot establish

None of this makes the tool useless. A dated, shareable report that says "this page is missing HTTPS and uses claim-style pressure language" is useful, especially when you want to warn someone without asking them to take your word for it. The value is in the forced pause and the record, not in a verdict.

It can establish: that a page is missing HTTPS; that its visible text uses pressure, reward, referral, or deposit vocabulary; that it could not be reached at scan time; and a dated, shareable record of what the page said.

It cannot establish: who owns the domain; whether the token or reward exists; whether the claim contract can drain a wallet; whether the page is a lookalike of a real project; whether the site will change after the scan; or whether the team is real.

The wallet prompt is where the actual risk lives. A page can score 24 and still ask for an approval that empties a wallet. A page can score 80 because it is a security tutorial. The score is a reason to slow down, not a permission slip.

A routine that uses the score correctly

1. Use the score to decide what to read carefully, not what to trust.
2. Check the domain against the official link in the project's docs or verified social account, character by character. A scan cannot do this for you.
3. If the report says the page could not be fetched or "insufficient evidence", treat the score as absent — not as a Medium-risk verdict.
4. Read each flag as a question to answer yourself. Where does the page ask for a deposit? Where does it mention a seed phrase? Does the wallet prompt ask for approve, permit, or setOwner?
5. Check whether the domain is disposable — quick tunnels, lookalike TLDs, hyphenated "claim-" names. A dated scan cannot tell you this.
6. Never treat a low score as permission. It means the scanner did not find matching text, which is not the same as safe.

Limitations

Thirty-one self-selected reports over two months is a small sample. All 31 were fallback scans, not full AI reviews. The scores are the platform's own and can change; my liveness re-check happened on a single day. I did not audit the projects, tokens, or contracts mentioned, and nothing here is financial advice. This article is about how to read a heuristic, not about which projects are legitimate.

The archive is worth browsing for exactly this reason: it is a record of what a first-pass scanner saw, including its own domain. Read it as a list of questions, and the number becomes useful. Read it as a verdict, and it will eventually be wrong in both directions.

Appendix: all 31 reports