Manual — Radar

Radar watches a project's site, its X account, its token mint (CA) and the dev's wallets on Solana mainnet, and shows what changed. It never trades, connects a wallet or scores "safe / scam".

How to read the feed

Every row is one of three things

Found in the first scan

The baseline: what was already there when we started watching. Not a recent change. You get one readiness summary, never an avalanche of alerts.

found in the first scan

Changed since monitoring started

Shows the previous successful check, the current detection, before → after and the saved evidence.

Detected at 12:04; absent at the 12:02 check.

Could not check

Timeout, block, rate limit, RPC unavailable. This is not deletion: the comparison is skipped and the previous data still stands.

could not check

Importance is not confidence

Two separate axes. Severity is how much an event may matter to a trader. Confidence is the quality of the evidence.

Severity	Example	Confidence	Why
crit	Token address (CA) replaced on the site	▮▮▮ high	visible on the page + RPC says SPL token mint
high	Dev wallet sold	▮▮▮ high	signed by the mint creator, signature linked
med	Snipers sold	▮▮▮ medium	heuristic: bought in the first 10 slots
low	Address inside a JS bundle	▮▮▮ low	no visible context

Time

firstObservedAt is when we saw it

firstObservedAt: When our system first saw the object. Not the publish, mint or deploy time.
previousObservedAt: The last successful, comparable check where the object was not there yet. Failed checks never count here.
sourcePublishedAt: The time the source itself reports (an X post, a slot's block time on-chain). Shown separately and labelled as source data.

All times are UTC.

Addresses

Four fields, all independent

Format

base58 · 32 bytes

A valid public key. Says nothing about whether the account exists. Transaction signatures (64 bytes) are never read as addresses.

On-chain type

mint · token_account · program · system_owned · not_found

The Solana RPC answer at check time (getAccountInfo): owned by the SPL Token or Token-2022 program and parsed as a mint → mint; an executable account → program; owned by the System Program → wallet (system_owned). A timeout is rpc_unavailable, not not_found.

Contextual role

project_token · treasury · payment_token · example …

Inferred from surrounding text, with signals and a confidence level.

Primary

the project token

A mint with the project_token role starts the token tracker.

!An RPC check is not a safety signal: "the mint exists" does not mean "the token is real".

Token tracker

Dev, linked wallets and snipers

When a project's token mint is found on the site or in its X posts, Radar starts one tracker for that mint, shared by everyone watching it. Once a minute it reads the new transactions of the mint and the tracked wallets since the last signature it processed, and writes each move to the feed.

dev wallet: The fee payer / first signer of the mint's earliest transaction (on pump.fun, the creator field). A fact from the chain; the creation slot is shown on the token card.
launchpad: The program the mint was created through (for example pump.fun), read from the creation transaction; otherwise "unknown".
bonding curve / pool: The pump.fun bonding curve or the DEX pool (Raydium, PumpSwap, Meteora…) the token trades against, when found. Sells and buys are swaps against these accounts.
dev-linked: Wallets that received SOL or the token directly from the dev (one hop). A heuristic, medium confidence; the linking transfer is linked on Solscan.
snipers: Distinct buyers in the first 10 slots after the token was created. A heuristic: early buyers are not always insiders.

What gets reported

DEV_SOLD / DEV_BOUGHT	The dev sold or bought, with the share of their holding.
DEV_BURN / DEV_BUYBACK_BURN	The dev burned tokens, or bought back and burned shortly after.
FEES_CLAIMED	The dev collected pump.fun creator fees (or other launchpad fees), in SOL. Unclaimed fees are shown on the token card when they can be derived, otherwise "unknown" — we never guess.
LINKED_WALLET_SOLD	A dev-linked wallet sold (heuristic).
SNIPER_SOLD	Snipers sold, summed per check: "3 snipers sold 12%" (heuristic).
LP_REMOVED / AUTHORITY_CHANGED	Liquidity removed by the dev; mint or freeze authority changed.

iEvery on-chain claim links to its transaction signature on Solscan. SOL amounts are shown only when the transaction proves them, otherwise "SOL amount unknown". Check it yourself before acting.

X / Twitter

Linked accounts, honest gaps

We follow X accounts that the project's own site links to, polling every minute. A token address (CA) in a post is checked on-chain and, if it is the project's token mint, starts the token tracker. Without an API key the X part shows "not configured" and everything else keeps working.

~Capture is not guaranteed: a post deleted within a minute may never be seen.

Availability

Down means measured, three times

unknownfirst check

upresponding

suspectone miss

downmeasured by us

suspect → up on the next successdown → recovering → up after 2 successes in a row

blocked: 403 / challenge / CAPTCHA. We don't bypass protection. Not counted as down.
monitoring delayed: Our checker is slow. Says nothing about the site. See Status.
down: Measured from our server. Not proof of a global outage.

Notifications

One event, one alert

Each event sends at most one notification per browser and per Telegram chat. Nothing to sign up for.

Browser push: A desktop notification, even with the tab closed. "Sent" means the push service accepted it, not that you read it. Turn it on →
Telegram: The same alerts in a chat with our bot, with buttons for evidence, mute and pause. Set it up →
Rules: By event type and minimum confidence. Quiet hours mean feed only. The baseline never sends alerts.

Coverage

"Not found" only means reachable part

Each project shows how much we could reach: complete partial or blocked. The first scan reads the start page, robots.txt and sitemap, up to 10 internal pages and the docs if they live on another domain. JSON endpoints we spot on the site are watched as "discovered APIs" — what we saw, not everything that exists.

iWe say "not found in the reachable part", never "absent". A blocked page could hold something we did not see.

Shared scans

Same link, one scan

Links are normalised, so https://Example.xyz/?ref=1 and example.xyz are the same project. If twenty people paste it, Radar runs one scan, one X poller and one token tracker; each person gets their own watch, mute and alert rules. A second paste shows the existing data instantly. Rescans have a 5-minute cooldown per project.

Safety

The crawler looks, it never acts

public sites only: Every fetch goes through a firewall that refuses private, loopback and metadata addresses, re-checked on every redirect.
no wallet: Never connects a wallet, never signs, never sends transactions or triggers claim actions.
GET only: Observed POST requests are never replayed.
external sites: DEX and launchpad pages are shown as links and are not crawled.