GET /scams/addresses
GET

/v1/scams/addresses

THE canonical scam blocklist: top-level addresses[] is the deduped union of every blocked account (drainers, dust/token spam, phishing, impersonation, fake airdrops, NFT-scam issuers). Check a Destination/counterparty against it BEFORE a user signs. Real-time, never cached (Cache-Control: no-store) — poll every ~5s. Per-category sections (nftPhishing, paymentDrain) are additive metadata and may overlap; addresses is deduped.

AuthNone — works without a key

Request

GEThttps://api.xrpl.to/v1/scams/addresses
Query parameterValueDescription
categorywallet_drainer|dust_spam|phishing|impersonation|fake_airdrop|other (optional)
curl 'https://api.xrpl.to/v1/scams/addresses'

Response

200Example response19 ms · just now · 1.0 KB · 34 lines
https://api.xrpl.to/v1/scams/addresses
{
  "success": true,
  "updatedAt": "2026-09-21T07:32:38.771Z",
  "count": 4984,
  "addresses": [
    "r13cHG7iwsHMFeFkVpf3NZYr1dRFiTS9v",
    "r1hEJo4VBe7ktLQaKs8fszDz3HS8SVKws",
    "r2mrM4K2tNfM3XeC4cMoYumKfE3Djrjen",
    "r313QBkNhstMBBWxXtovCLtaBdz1Pxr5j7",
    "r31qez8eY6BKieHEHmcsEDt82EEuvnDByk"
  ],
  "nftPhishing": {
    "description": "NFT minting & sell-offer phishing — scam NFT issuer addresses.",
    "count": 4099,
    "addresses": [
      "r13cHG7iwsHMFeFkVpf3NZYr1dRFiTS9v",
      "r1hEJo4VBe7ktLQaKs8fszDz3HS8SVKws",
      "r2mrM4K2tNfM3XeC4cMoYumKfE3Djrjen",
      "r313QBkNhstMBBWxXtovCLtaBdz1Pxr5j7",
      "r31qez8eY6BKieHEHmcsEDt82EEuvnDByk"
    ]
  },
  "paymentDrain": {
    "description": "Verification-sign payment-request drain — confirmed wallet drainers.",
    "count": 1180,
    "addresses": [
      "r4MjGzHhKDyEaQJf8XNm14Asfwqqd6NX6R",
      "r4duMqEXMMmWpaN8LC2URmmVE2JkqTT5ig",
      "rpnu6dEV7zKiGybS6NFviiFUCdQEjHanqi",
      "rU7dx6W4YUaKMk5exCgEC8e9j7gY39UnDF",
      "r3n8sbJGiJe1jG1CT9V1m7Ptu4a3AiHpN1"
    ]
  }
}

Long arrays and strings are shortened in the example; Send request for the full answer.

What it does

THE canonical scam blocklist: top-level addresses[] is the deduped union of every blocked account (drainers, dust/token spam, phishing, impersonation, fake airdrops, NFT-scam issuers). Check a Destination/counterparty against it BEFORE a user signs. Real-time, never cached (Cache-Control: no-store) — poll every ~5s. Per-category sections (nftPhishing, paymentDrain) are additive metadata and may overlap; addresses is deduped.

For one wallet use GET /v1/scams/check/{account}; for the whole list, GET /v1/scams/addresses.
OpenAPI