trenchcoat
Free · no sign-up
Website report · 31 Oct 2026

safu.klin.lol

“$SAFU · Traders are refunding Binance”

Template-written 21 evidence items Code reader analysed 2 scripts
What this means for you

safu.klin.lol talked to 3 outside services on a first visit, including 1 that measures visits or shows ads.E6

  • Tech check: the site mentions on-chain / smart contracts, but we found nothing behind it in what its public page loads.E19
  • What loads is a page only: no calls to its own backend, no wallet code, no contract calls, no AI services and no live connections.E20
  • Before you click anything, the page loads analytics or ad services: Cloudflare Web Analytics.E6

Tech check

What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.

Nothing found on the public page

On-chain / smart contracts

“…ours. This is what happened, step by step, from public on-chain reporting. SCROLL ↓ TAKEN FROM BINANCE $2,511,500,000…”E19

No matching code, calls or services in what loaded for us.

Calls its own backend none seen
Wallet code none seen
Contract calls in its code none seen
Talks to AI services none seen
Live connections none seen

What loads is a page only: no own backend calls, wallet code, contract calls, AI services or live connections.E20

Contract address on the page: 0xef4d44…7777 · check the contract 0xa8c7e6…3277 · check the contract 0x244970…5bd5 · check the contract

What it is

  • The Internet Archive has never saved this site, so it is probably new.E21
  • The site describes itself as: “On 29 October 2026 Binance's hot wallets were drained of $6.3 billion. $SAFU sends its trading fees to Binance's hot wallet, with a public r”E2
  • In your browser it can copy text to your clipboard.E8
  • It has sections such as /proof, /whitepaper and /api.E11

Where your data goes

Analytics & trackingCount visits and record what you do on the page. 1
static.cloudflareinsights.comCloudflare Web Analytics: page-view counter 1×E6
FontsDownload typefaces. 2
fonts.gstatic.comGoogle Fonts: fonts 2×E7
fonts.googleapis.comGoogle Fonts: fonts 1×E5

How key features work

Measuring what you do

Visits and clicks are measured with Cloudflare Web Analytics (found in its traffic or its code).E6

Cloudflare Web Analytics

Pages and API calls

Pages it links to

//proof/whitepaper/api

Endpoints

Called while loading (seen) or named in the code (code).

/api/statscodeE9
/api/healthcodeE10

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

E1
Page title: $SAFU · Traders are refunding Binance
page title · https://safu.klin.lol/
E2
Page description: On 29 October 2026 Binance's hot wallets were drained of $6.3 billion. $SAFU sends its trading fees to Binance's hot wallet, with a public receipt for
page description · https://safu.klin.lol/
E3
Main heading: $6.3 billion. One night.
page h1 · https://safu.klin.lol/
E4
4 request(s) to safu.klin.lol
types: 1 document, 1 stylesheet, 1 image
GET https://safu.klin.lol/ · document · 4 requests · network recording
E5
1 request(s) to fonts.googleapis.com
types: 1 stylesheet
GET https://fonts.googleapis.com/css2 · stylesheet · network recording
E6
1 request(s) to static.cloudflareinsights.com
types: 1 script
GET https://static.cloudflareinsights.com/beacon.min.js/vce701823e78c4301a35b7e07294d87301792088814092 · script · network recording
E7
2 request(s) to fonts.gstatic.com
types: 2 font
GET https://fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 · font · 2 requests · network recording
E8
Uses the browser ability: clipboard_write
can copy text to your clipboard
safu.klin.lol/ (page HTML) @ 216:94 · “clipboard.writeText(” · pattern scan
E9
Code reader found the endpoint /api/stats
how: call:fetch
safu.klin.lol/ @ 35:19 · “/api/stats” · The code reader analyze-web-bundle 6.4.0
E10
The code names the endpoint /api/health
safu.klin.lol/ (page HTML) @ 127:84 · “/api/health” · pattern scan
E11
4 links to pages on the same site
page links · https://safu.klin.lol/ · /, /proof, /whitepaper, /api
E12
Address in code: 0xef4d44b17d9422d2c64b6078cfa3d1a1e9e37777
safu.klin.lol/ (page HTML) @ 18:47 · “0xef4d44b17d9422d2c64b6078cfa3d1a1e9e37777” · pattern scan
E13
Address in code: 0xf977814e90da44bfa03b6295a0616a897441acec
safu.klin.lol/ (page HTML) @ 125:120 · “0xf977814e90da44bfa03b6295a0616a897441acec” · pattern scan
E14
Address in code: 0xa8c7e6aa73ca37c3a5f5c6238e72b10519743277
safu.klin.lol/ (page HTML) @ 126:44 · “0xa8c7e6aa73ca37c3a5f5c6238e72b10519743277” · pattern scan
E15
Address in code: 0xaeaf2012a20feb3b917e70e095b787f95074bc67
safu.klin.lol/ (page HTML) @ 162:72 · “0xaeaf2012a20feb3b917e70e095b787f95074bc67” · pattern scan
E16
Address in code: 0x4fa1daf1e03759e802452f5543171fa19c0209d7
safu.klin.lol/ (page HTML) @ 162:454 · “0x4fa1daf1e03759e802452f5543171fa19c0209d7” · pattern scan
E17
Address in code: 0xbeaf868dac903938a1783da02e7417dedb7cb893
safu.klin.lol/ (page HTML) @ 162:837 · “0xbeaf868dac903938a1783da02e7417dedb7cb893” · pattern scan
E18
Address in code: 0x24497068ca4166ca32a04ae530ce00cf79755bd5
safu.klin.lol/ (page HTML) @ 164:105 · “0x24497068ca4166ca32a04ae530ce00cf79755bd5” · pattern scan
E19
The site says: “…ours. This is what happened, step by step, from public on-chain reporting. SCROLL ↓ TAKEN FROM BINANCE $2,511,500,000…”
page text · https://safu.klin.lol/ · …ours. This is what happened, step by step, from public on-chain reporting. SCROLL ↓ TAKEN FROM BINANCE $2,511,500,000…
E20
8 requests on load: no own backend calls, wallet code, contract calls, AI services or live connections
GET https://safu.klin.lol/ · summary · 8 requests · network recording
E21
The Internet Archive has no saved copy of safu.klin.lol
page web archive · https://web.archive.org/web/*/safu.klin.lol

Limits

  • We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
  • Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
  • Some trackers only load after you accept cookies or log in, so the real list can be longer.
  • We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
  • The tech check compares the site's own words with what its public page loads. Work done on servers, in private code or in separate apps isn't visible here, so 'nothing found' means not visible on the public page, not that it doesn't exist.
  • This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id ZDjNWlhf.