/v1/scams/addresses
THE canonical scam blocklist: top-level addresses[] is the deduped union of every blocked account (drainers, dust/token spam, phishing, impersonation, fake airdrops, NFT-scam issuers). Check a Destination/counterparty against it BEFORE a user signs. Real-time, never cached (Cache-Control: no-store) — poll every ~5s. Per-category sections (nftPhishing, paymentDrain) are additive metadata and may overlap; addresses is deduped.
Request
https://api.xrpl.to/v1/scams/addresses| Query parameter | Value | Description |
|---|---|---|
| category | wallet_drainer|dust_spam|phishing|impersonation|fake_airdrop|other (optional) |
curl 'https://api.xrpl.to/v1/scams/addresses'
Response
https://api.xrpl.to/v1/scams/addresses{ "success": true, "updatedAt": "2026-10-19T06:43:35.923Z", "count": 5370, "addresses": [ "r13cHG7iwsHMFeFkVpf3NZYr1dRFiTS9v", "r1hEJo4VBe7ktLQaKs8fszDz3HS8SVKws", "r2mrM4K2tNfM3XeC4cMoYumKfE3Djrjen", "r313QBkNhstMBBWxXtovCLtaBdz1Pxr5j7", "r31qez8eY6BKieHEHmcsEDt82EEuvnDByk" ], "nftPhishing": { "description": "NFT minting & sell-offer phishing — scam NFT issuer addresses.", "count": 2749, "addresses": [ "r13cHG7iwsHMFeFkVpf3NZYr1dRFiTS9v", "r1hEJo4VBe7ktLQaKs8fszDz3HS8SVKws", "r2mrM4K2tNfM3XeC4cMoYumKfE3Djrjen", "r313QBkNhstMBBWxXtovCLtaBdz1Pxr5j7", "r31qez8eY6BKieHEHmcsEDt82EEuvnDByk" ] }, "paymentDrain": { "description": "Confirmed wallet drainers and the wallets that move their proceeds, every campaign.", "count": 5032, "addresses": [ "rDNTV8E3S1kje9XeDc8QQhaVhPjph6jndE", "rPv7KJNy9wzXbBhXMrrZp6JhowPcnX17Ru", "rPtYpgvxa4snqW788K5tgMe5YXRbBPXQqz", "rMmgEK3EUpgy9gAm5xWRj7R45KMa54FSvp", "rS4Km9xwzAXzEBtabegrvTWDg2AJK2A1u" ] } }
Long arrays and strings are shortened in the example; Send request for the full answer.
What it does
THE canonical scam blocklist: top-level addresses[] is the deduped union of every blocked account (drainers, dust/token spam, phishing, impersonation, fake airdrops, NFT-scam issuers). Check a Destination/counterparty against it BEFORE a user signs. Real-time, never cached (Cache-Control: no-store) — poll every ~5s. Per-category sections (nftPhishing, paymentDrain) are additive metadata and may overlap; addresses is deduped.