Where a Blink actually points
A Blink is a link a wallet turns into a button. What you see is a title and an icon; what runs is an HTTP endpoint that hands back a transaction — and the two can be on different domains. Evidesa reads the link without calling it and names both.
It also says what the registry wallets consult holds about that host, which is worth knowing for a reason the registry does not advertise: it is an allowlist that grows and does not shrink.
Why the transaction is not fetched. Asking a Blink for its transaction means sending it an account address that may sign. Sending yours would hand it to a host you are still deciding about; sending an invented one produces a transaction built for a wallet that does not exist. Tested against seven live Blinks with a synthetic account, five returned errors rather than a transaction — and the five were the interesting ones, because swaps, burns and account closures depend on the state of the account asking. A decode built on that would be least reliable exactly where it mattered most. When you have the real bytes, the transaction pre-check reads them and asks nobody for your address.
What the registry is, and is not. At least one major wallet renders only Actions registered in it, which makes it a security control whether or not it is maintained as one. Measured on 2026-08-08: it lists over a thousand action hosts, and a random sample of sixty found 40% no longer resolving in DNS at all. Registration is an application, not an audit, and a host being listed says only that it was listed.
What happens to the link you paste. It is parsed, and at most two ordinary GET requests are made: one for the registry, one for the host's own actions.json. The endpoint itself is never called. The link is not stored, not logged, and never placed in a URL.
Evidesa is not financial advice and does not certify safety. Nothing here establishes that a Blink is safe to open.