Skip to main content
GET
Detect address poisoning for a specific wallet address

Authorizations

x-api-key
string
header
required

Path Parameters

address
string
required

The wallet address to check for poisoning attempts

Query Parameters

chain
enum<string>
required

The EVM-compatible blockchain network to search for poisoning activity

Available options:
eth,
base,
bsc,
pol,
opt,
arb,
robinhood
useCache
boolean
default:true

Whether to use cached data if available (default: true)

refetchData
boolean
default:false

Whether to schedule a background refresh (default: false)

Response

Successful operation

poisoning_detected
boolean
required

Indicates whether potential address poisoning was detected

status
string
required

Status of the poisoning check operation

Example:

"success"

suspicious_transactions
object[]
required

List of transactions that appear suspicious for address poisoning

summary
object

Summary statistics for the poisoning analysis

poisoners
object[]

Look-alike addresses an attacker planted in this wallet's history. Each one entered the history through a poison transfer (a zero-value token transfer, a fake token, or dust) and shares its leading and trailing characters with impersonated, an address the wallet had already transacted with for real. A high-confidence poisoner is recorded as a candidate and tagged address_poisoner (medium risk) once corroborated (seen against two distinct established victims, a zero-value or dust transfer it signed to a victim, or analyst approval), so a risk lookup of that address flags it then. impersonated is never tagged. Absent when the detection service does not report poisoners.

poisoners_detected
boolean

True when poisoners has at least one high-confidence entry. poisoning_detected keeps its meaning: the model's verdict on suspicious_transactions.

poisoner_error
boolean

True when poisoner identification failed for this scan: an empty poisoners then means unknown, not none.