/v1/scams

{
  "success": true,
  "how_to_report": {
    "description": "Each domain below includes pre-written email templates you can send to the registrar and hosting provider abuse teams. Copy the subject and body, then send to the abuse_email address listed.",
    "steps": [
      "1. Domains marked priority \"high\" are still ONLINE and actively scamming users — report these first",
      "2. Copy the email subject and body from the email_template",
      "3. Send it to the abuse_email address",
      "4. Report to both the registrar AND the hosting provider for maximum impact"
    ]
  },
  "domains": [
    {
      "domain": "xrp-api.com",
      "status": "active",
      "source": "abuse_report",
      "description": "This domain is a phishing site impersonating XRP-API, a NFT voucher scam infrastructure on the XRP Ledger, used to steal LP tokens and XRP. It targets users to steal their credentials and funds.",
      "discovered_at": "2026-02-14T05:14:19.069216659+00:00",
      "taken_down_at": null,
      "report_to": [
        {
          "type": "registrar",
          "name": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
          "abuse_email": "abuse@nicenic.net",
          "reported_at": "2026-02-14T05:14:19.069216659+00:00",
          "email_template": {
            "subject": "Abuse Report: Domain \"xrp-api.com\" used in XRPL cryptocurrency scams",
            "body": "Dear Abuse Team,\n\nWe are reporting the domain \"xrp-api.com\" for its involvement in cryptocurrency scams on the XRP Ledger (XRPL).\n\nThis domain is a phishing site impersonating XRP-API, a NFT voucher scam infrastructure on the XRP Ledger, used to steal LP tokens and XRP. It targets users to steal their credentials and funds.\n\nWe request that you investigate this domain and take appropriate action p…"
          }
        },
        {
          "type": "hosting_provider",
          "name": "cloudflare.com",
          "abuse_email": "abuse@cloudflare.com",
          "reported_at": "2026-02-14T05:14:22.920662526+00:00",
          "email_template": {
            "subject": "Abuse Report: \"xrp-api.com\" hosted on your infrastructure - cryptocurrency scam",
            "body": "Dear Abuse Team,\n\nWe are reporting the domain \"xrp-api.com\" which is hosted on / proxied through your infrastructure. This domain is being used in cryptocurrency scams on the XRP Ledger (XRPL).\n\nThis domain is a phishing site impersonating XRP-API, a NFT voucher scam infrastructure on the XRP Ledger, used to steal LP tokens and XRP. It targets users to steal their credentials and funds.\n\nThis acti…"
          }
        }
      ]
    },
    {
      "domain": "xrparmystoken.com",
      "status": "active",
      "source": "abuse_report",
      "description": "This domain is a phishing site impersonating XRP Army, a community token on the XRP Ledger (legitimate site: xrparmytoken.com). It targets users to steal their credentials and funds.",
      "discovered_at": "2026-02-14T07:11:48.267434565+00:00",
      "taken_down_at": null,
      "report_to": [
        {
          "type": "registrar",
          "name": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
          "abuse_email": "abuse@nicenic.net",
          "reported_at": "2026-02-14T07:11:48.267434565+00:00",
          "email_template": {
            "subject": "Abuse Report: Domain \"xrparmystoken.com\" used in XRPL cryptocurrency scams",
            "body": "Dear Abuse Team,\n\nWe are reporting the domain \"xrparmystoken.com\" for its involvement in cryptocurrency scams on the XRP Ledger (XRPL).\n\nThis domain is a phishing site impersonating XRP Army, a community token on the XRP Ledger (legitimate site: xrparmytoken.com). It targets users to steal their credentials and funds.\n\nWe request that you investigate this domain and take appropriate action per you…"
          }
        },
        {
          "type": "hosting_provider",
          "name": "cloudflare.com",
          "abuse_email": "abuse@cloudflare.com",
          "reported_at": "2026-02-14T07:11:48.914642999+00:00",
          "email_template": {
            "subject": "Abuse Report: \"xrparmystoken.com\" hosted on your infrastructure - cryptocurrency scam",
            "body": "Dear Abuse Team,\n\nWe are reporting the domain \"xrparmystoken.com\" which is hosted on / proxied through your infrastructure. This domain is being used in cryptocurrency scams on the XRP Ledger (XRPL).\n\nThis domain is a phishing site impersonating XRP Army, a community token on the XRP Ledger (legitimate site: xrparmytoken.com). It targets users to steal their credentials and funds.\n\nThis activity v…"
          }
        }
      ]
    },
    {
      "domain": "phnix.app",
      "status": "active",
      "source": "abuse_report",
      "description": "This domain is a phishing site impersonating PHNIX, a meme coin on the XRP Ledger (legitimate site: phnix.lol). It targets users to steal their credentials and funds.",
      "discovered_at": "2026-02-14T07:26:12.162814475+00:00",
      "taken_down_at": null,
      "report_to": [
        {
          "type": "hosting_provider",
          "name": "cloudflare",
          "abuse_email": "abuse@cloudflare",
          "reported_at": "2026-02-14T07:26:12.162814475+00:00",
          "email_template": {
            "subject": "Abuse Report: \"phnix.app\" hosted on your infrastructure - cryptocurrency scam",
            "body": "Dear Abuse Team,\n\nWe are reporting the domain \"phnix.app\" which is hosted on / proxied through your infrastructure. This domain is being used in cryptocurrency scams on the XRP Ledger (XRPL).\n\nThis domain is a phishing site impersonating PHNIX, a meme coin on the XRP Ledger (legitimate site: phnix.lol). It targets users to steal their credentials and funds.\n\nThis activity violates your Terms of Se…"
          }
        }
      ]
    },
    {
      "domain": "node1.irys.xyz",
      "status": "active",
      "source": "abuse_report",
      "description": "This domain is a phishing site impersonating Irys, a data storage network exploited as NFT scam infrastructure on the XRP Ledger. It targets users to steal their credentials and funds.",
      "discovered_at": "2026-02-14T12:46:04.189097439+00:00",
      "taken_down_at": null,
      "report_to": [
        {
          "type": "hosting_provider",
          "name": "cloudflare.com",
          "abuse_email": "abuse@cloudflare.com",
          "reported_at": "2026-02-14T12:46:04.189097439+00:00",
          "email_template": {
            "subject": "Abuse Report: \"node1.irys.xyz\" hosted on your infrastructure - cryptocurrency scam",
            "body": "Dear Abuse Team,\n\nWe are reporting the domain \"node1.irys.xyz\" which is hosted on / proxied through your infrastructure. This domain is being used in cryptocurrency scams on the XRP Ledger (XRPL).\n\nThis domain is a phishing site impersonating Irys, a data storage network exploited as NFT scam infrastructure on the XRP Ledger. It targets users to steal their credentials and funds.\n\nThis activity vi…"
          }
        }
      ]
    },
    {
      "domain": "take589.com",
      "status": "active",
      "source": "abuse_report",
      "description": "This domain is a phishing site impersonating Take589, a fake XRP giveaway scam on the XRP Ledger. It targets users to steal their credentials and funds.",
      "discovered_at": "2026-02-14T12:46:06.641501575+00:00",
      "taken_down_at": null,
      "report_to": [
        {
          "type": "registrar",
          "name": "Dominet (HK) Limited",
          "abuse_email": "domainabuse@service.aliyun.com",
          "reported_at": "2026-02-14T12:46:06.641501575+00:00",
          "email_template": {
            "subject": "Abuse Report: Domain \"take589.com\" used in XRPL cryptocurrency scams",
            "body": "Dear Abuse Team,\n\nWe are reporting the domain \"take589.com\" for its involvement in cryptocurrency scams on the XRP Ledger (XRPL).\n\nThis domain is a phishing site impersonating Take589, a fake XRP giveaway scam on the XRP Ledger. It targets users to steal their credentials and funds.\n\nWe request that you investigate this domain and take appropriate action per your abuse policies.\n\nEvidence: https:/…"
          }
        },
        {
          "type": "hosting_provider",
          "name": "cloudflare.com",
          "abuse_email": "abuse@cloudflare.com",
          "reported_at": "2026-02-14T12:46:07.336138515+00:00",
          "email_template": {
            "subject": "Abuse Report: \"take589.com\" hosted on your infrastructure - cryptocurrency scam",
            "body": "Dear Abuse Team,\n\nWe are reporting the domain \"take589.com\" which is hosted on / proxied through your infrastructure. This domain is being used in cryptocurrency scams on the XRP Ledger (XRPL).\n\nThis domain is a phishing site impersonating Take589, a fake XRP giveaway scam on the XRP Ledger. It targets users to steal their credentials and funds.\n\nThis activity violates your Terms of Service. We re…"
          }
        }
      ]
    }
  ]
}

Long arrays and strings are shortened in the example; Send request for the full answer.