/v1/scams/addresses
THE canonical scam blocklist: top-level addresses[] is the deduped union of every blocked account (drainers, dust/token spam, phishing, impersonation, fake airdrops, NFT-scam issuers). Check a Destination/counterparty against it BEFORE a user signs. Real-time, never cached (Cache-Control: no-store) — poll every ~5s. Per-category sections (nftPhishing, paymentDrain) are additive metadata and may overlap; addresses is deduped.
Request
https://api.xrpl.to/v1/scams/addresses| Query parameter | Value | Description |
|---|---|---|
| category | wallet_drainer|dust_spam|phishing|impersonation|fake_airdrop|other (optional) |
curl 'https://api.xrpl.to/v1/scams/addresses'
Response
https://api.xrpl.to/v1/scams/addresses{ "success": true, "updatedAt": "2026-09-21T07:32:38.771Z", "count": 4984, "addresses": [ "r13cHG7iwsHMFeFkVpf3NZYr1dRFiTS9v", "r1hEJo4VBe7ktLQaKs8fszDz3HS8SVKws", "r2mrM4K2tNfM3XeC4cMoYumKfE3Djrjen", "r313QBkNhstMBBWxXtovCLtaBdz1Pxr5j7", "r31qez8eY6BKieHEHmcsEDt82EEuvnDByk" ], "nftPhishing": { "description": "NFT minting & sell-offer phishing — scam NFT issuer addresses.", "count": 4099, "addresses": [ "r13cHG7iwsHMFeFkVpf3NZYr1dRFiTS9v", "r1hEJo4VBe7ktLQaKs8fszDz3HS8SVKws", "r2mrM4K2tNfM3XeC4cMoYumKfE3Djrjen", "r313QBkNhstMBBWxXtovCLtaBdz1Pxr5j7", "r31qez8eY6BKieHEHmcsEDt82EEuvnDByk" ] }, "paymentDrain": { "description": "Verification-sign payment-request drain — confirmed wallet drainers.", "count": 1180, "addresses": [ "r4MjGzHhKDyEaQJf8XNm14Asfwqqd6NX6R", "r4duMqEXMMmWpaN8LC2URmmVE2JkqTT5ig", "rpnu6dEV7zKiGybS6NFviiFUCdQEjHanqi", "rU7dx6W4YUaKMk5exCgEC8e9j7gY39UnDF", "r3n8sbJGiJe1jG1CT9V1m7Ptu4a3AiHpN1" ] } }
Long arrays and strings are shortened in the example; Send request for the full answer.
What it does
THE canonical scam blocklist: top-level addresses[] is the deduped union of every blocked account (drainers, dust/token spam, phishing, impersonation, fake airdrops, NFT-scam issuers). Check a Destination/counterparty against it BEFORE a user signs. Real-time, never cached (Cache-Control: no-store) — poll every ~5s. Per-category sections (nftPhishing, paymentDrain) are additive metadata and may overlap; addresses is deduped.