/v1/scams/addresses
THE canonical scam blocklist: top-level addresses[] is the deduped union of every blocked account (drainers, dust/token spam, phishing, impersonation, fake airdrops, NFT-scam issuers). Check a Destination/counterparty against it BEFORE a user signs. Real-time, never cached (Cache-Control: no-store) — poll every ~5s. Per-category sections (nftPhishing, paymentDrain) are additive metadata and may overlap; addresses is deduped.
Request
https://api.xrpl.to/v1/scams/addresses| Query parameter | Value | Description |
|---|---|---|
| category | wallet_drainer|dust_spam|phishing|impersonation|fake_airdrop|other (optional) |
curl 'https://api.xrpl.to/v1/scams/addresses'
Response
https://api.xrpl.to/v1/scams/addresses{ "success": true, "updatedAt": "2026-10-12T01:05:06.554Z", "count": 5275, "addresses": [ "r13cHG7iwsHMFeFkVpf3NZYr1dRFiTS9v", "r1hEJo4VBe7ktLQaKs8fszDz3HS8SVKws", "r2mrM4K2tNfM3XeC4cMoYumKfE3Djrjen", "r313QBkNhstMBBWxXtovCLtaBdz1Pxr5j7", "r31qez8eY6BKieHEHmcsEDt82EEuvnDByk" ], "nftPhishing": { "description": "NFT minting & sell-offer phishing — scam NFT issuer addresses.", "count": 2739, "addresses": [ "r13cHG7iwsHMFeFkVpf3NZYr1dRFiTS9v", "r1hEJo4VBe7ktLQaKs8fszDz3HS8SVKws", "r2mrM4K2tNfM3XeC4cMoYumKfE3Djrjen", "r313QBkNhstMBBWxXtovCLtaBdz1Pxr5j7", "r31qez8eY6BKieHEHmcsEDt82EEuvnDByk" ] }, "paymentDrain": { "description": "Confirmed wallet drainers and the wallets that move their proceeds, every campaign.", "count": 4937, "addresses": [ "rHVmKEY7LCKH5Ead6MdcVVS2ba2KxgQxCW", "rpPSANkY3WuxNbhzz5WxjTm3c7rosXBnqn", "rxLfrvic9BP4atxcz433ZcdbHUknKFixM", "rNrmFvAbapEpWfrdndXhKdoqxhAXd9bg68", "rpazgNxytBajXmm6P34hTStPK3WBSDCJN4" ] } }
Long arrays and strings are shortened in the example; Send request for the full answer.
What it does
THE canonical scam blocklist: top-level addresses[] is the deduped union of every blocked account (drainers, dust/token spam, phishing, impersonation, fake airdrops, NFT-scam issuers). Check a Destination/counterparty against it BEFORE a user signs. Real-time, never cached (Cache-Control: no-store) — poll every ~5s. Per-category sections (nftPhishing, paymentDrain) are additive metadata and may overlap; addresses is deduped.