# Address Poisoning Detector

> Address Poisoning Detector is a paid API for AI agents from forensik.halowerk.com, paid per call via x402, $0.001/call, status unknown (last checked 2026-11-02).

Analyzes caller-supplied evidence signals to classify whether a blockchain address is involved in address poisoning attacks, with explicit confidence scores and thresholds.

## Facts

- Endpoint: POST https://forensik.halowerk.com/v1/address-poisoning-detector?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-11-02
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/address-poisoning-detector-0b6807de
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_QPQjYETLRCImkocy38eph

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability address-poisoning-detector-0b6807de -d '<json body>'
```

Example prompt: Check whether this address 0xAbC...123 is likely involved in address poisoning — I've seen 5 lookalike transfers, a prefix-suffix match of 4 characters, and 3 zero-value bait transactions observed at 2024-06-15T10:00:00Z from my mempool scanner.

## When to prefer this

Choose this endpoint when you have already gathered on-chain evidence signals (lookalike transfer counts, prefix-suffix character matches, zero-value bait counts) and need a structured, threshold-explicit classification of address poisoning risk without making live chain queries. It is especially useful in compliance pipelines, automated alert triage, or when auditing suspicious addresses offline from caller-collected data. Prefer it over generic blockchain analytics when you want transparent scoring thresholds and explicit accounting of missing signals.

## Known failure modes

- Missing required evidence items when strict mode is enabled returns a rejection
- Insufficient minimum evidence (fewer than 1 item) causes validation error
- Unrecognized metric names cause schema validation failure
- Malformed ISO-8601 timestamps on evidence items cause parsing errors
- Confidence may be low if key signals like lookalike_transfers are absent

## How this service works

Address Poisoning Detector analyses only the evidence supplied by the caller. It does not claim to query a chain, identify a legal status or replace an independent audit. Missing signals lower confidence and are listed explicitly; every classification includes the exact thresholds used.

## Output

Returns a classification of whether the subject address exhibits address poisoning behavior, along with the confidence level, the exact thresholds applied, and an explicit list of any signals that were missing from the supplied evidence, enabling the caller to understand both the verdict and its evidentiary basis.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "strict": {
   "type": "boolean",
   "default": false,
   "description": "Reject unless all documented metrics are supplied."
  },
  "context": {
   "type": "object",
   "description": "Optional non-secret labels returned unchanged for correlation.",
   "maxProperties": 20,
   "additionalProperties": {
    "type": [
     "string",
     "number",
     "boolean",
     "null"
    ]
   }
  },
  "subject": {
   "type": "string",
   "maxLength": 256,
   "minLength": 1,
   "description": "Address, transaction, protocol, asset, proposal or other subject being assessed."
  },
  "evidence": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "metric",
     "value"
    ],
    "properties": {
     "note": {
      "type": "string",
      "maxLength": 500
     },
     "value": {
      "type": [
       "number",
       "boolean"
      ]
     },
     "metric": {
      "enum": [
       "lookalike_transfers",
       "prefix_suffix_match_chars",
       "zero_value_bait_count"
      ],
      "type": "string"
     },
     "source": {
      "type": "string",
      "maxLength": 300,
      "minLength": 1,
      "description": "Evidence source or query identifier."
     },
     "timestamp": {
      "type": "string",
      "maxLength": 40,
      "minLength": 10,
      "description": "ISO-8601 observation time."
     }
    },
    "additionalProperties": false
   },
   "maxItems": 50,
   "minItems": 1,
   "description": "Caller-supplied observations. Repeated metrics form a time series; the newest timestamp is assessed."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "scope": "caller_supplied_evidence_only",
  "engine": "detector",
  "service": "Address Poisoning Detector",
  "subject": "address-poisoning-detector-sample",
  "confidence": 100,
  "risk_score": 15,
  "generated_at": "2026-10-23T00:07:35.704Z",
  "classification": "low",
  "recommendation": "No supplied metric crossed a warning thr",
  "service_number": 93
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/address-poisoning-detector-0b6807de/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from forensik.halowerk.com](https://www.zero.xyz/host/forensik.halowerk.com/llms.txt)