{"uid":"cap_QPQjYETLRCImkocy38eph","slug":"address-poisoning-detector-0b6807de","name":"Address Poisoning Detector","description":"Address Poisoning Detector analyses only the evidence supplied by the caller. It does not claim to query a chain, identify a legal status or replace an independent audit. Missing signals lower confidence and are listed explicitly; every classification includes the exact thresholds used.","url":"https://forensik.halowerk.com/v1/address-poisoning-detector?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"strict":{"type":"boolean","default":false,"description":"Reject unless all documented metrics are supplied."},"context":{"type":"object","description":"Optional non-secret labels returned unchanged for correlation.","maxProperties":20,"additionalProperties":{"type":["string","number","boolean","null"]}},"subject":{"type":"string","maxLength":256,"minLength":1,"description":"Address, transaction, protocol, asset, proposal or other subject being assessed."},"evidence":{"type":"array","items":{"type":"object","required":["metric","value"],"properties":{"note":{"type":"string","maxLength":500},"value":{"type":["number","boolean"]},"metric":{"enum":["lookalike_transfers","prefix_suffix_match_chars","zero_value_bait_count"],"type":"string"},"source":{"type":"string","maxLength":300,"minLength":1,"description":"Evidence source or query identifier."},"timestamp":{"type":"string","maxLength":40,"minLength":10,"description":"ISO-8601 observation time."}},"additionalProperties":false},"maxItems":50,"minItems":1,"description":"Caller-supplied observations. Repeated metrics form a time series; the newest timestamp is assessed."}}},"responseSchema":{"type":"json","example":{"scope":"caller_supplied_evidence_only","engine":"detector","service":"Address Poisoning Detector","subject":"address-poisoning-detector-sample","confidence":100,"risk_score":15,"generated_at":"2026-10-23T00:07:35.704Z","classification":"low","recommendation":"No supplied metric crossed a warning thr","service_number":93}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_UJLsCyBMhHVepAWIxBYXk","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes caller-supplied evidence signals to classify whether a blockchain address is involved in address poisoning attacks, with explicit confidence scores and thresholds.","exampleAgentPrompt":"Check whether this address 0xAbC...123 is likely involved in address poisoning — I've seen 5 lookalike transfers, a prefix-suffix match of 4 characters, and 3 zero-value bait transactions observed at 2024-06-15T10:00:00Z from my mempool scanner.","exampleUseCases":[{"title":"Wallet safety check before sending funds","prompt":"Before I send 10 ETH to 0xDe...F9, can you check if it's a poisoned lookalike? I've seen 8 lookalike transfers, 6 matching prefix-suffix characters, and 2 zero-value bait transactions flagged by my block explorer at 2024-07-01T14:22:00Z."},{"title":"DeFi protocol address validation","prompt":"Our protocol's multisig received a suspicious incoming transfer — run an address poisoning check on 0xAb...99 using these signals: 12 lookalike transfers, 5 prefix-suffix match chars, and 0 zero-value bait transactions, all observed at 2024-08-10T09:00:00Z from our node."},{"title":"Automated compliance alert triage","prompt":"Triage this flagged address 0x11...CC for address poisoning — evidence is 2 lookalike transfers, 3 matching characters at prefix/suffix, and 7 zero-value bait counts, timestamped 2024-09-05T17:45:00Z from our compliance scanner, and reject if any signal is missing."}],"resultDescription":"Returns a classification of whether the subject address exhibits address poisoning behavior, along with the confidence level, the exact thresholds applied, and an explicit list of any signals that were missing from the supplied evidence, enabling the caller to understand both the verdict and its evidentiary basis.","failureModes":["Missing required evidence items when strict mode is enabled returns a rejection","Insufficient minimum evidence (fewer than 1 item) causes validation error","Unrecognized metric names cause schema validation failure","Malformed ISO-8601 timestamps on evidence items cause parsing errors","Confidence may be low if key signals like lookalike_transfers are absent"],"whenToPreferThis":"Choose this endpoint when you have already gathered on-chain evidence signals (lookalike transfer counts, prefix-suffix character matches, zero-value bait counts) and need a structured, threshold-explicit classification of address poisoning risk without making live chain queries. It is especially useful in compliance pipelines, automated alert triage, or when auditing suspicious addresses offline from caller-collected data. Prefer it over generic blockchain analytics when you want transparent scoring thresholds and explicit accounting of missing signals.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-11-02T00:30:23.616Z","isFirstParty":false,"canonicalSlug":"address-poisoning-detector-0b6807de"}