# Address Poisoning Look-alike Detector

> Address Poisoning Look-alike Detector is a paid API for AI agents from x402.dailyelo.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-12).

Checks whether a recipient EVM address is a poisoning look-alike of any known/trusted address by comparing head and tail segments

## Facts

- Endpoint: POST https://x402.dailyelo.com/v1/address-poison-check?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/address-poisoning-look-alike-detector-e25ff4c7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Z0d2qK7I0i0ZXAkKABvWe

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability address-poisoning-look-alike-detector-e25ff4c7 -d '<json body>'
```

Example prompt: Before I send those funds, check if 0xA9D1e08C7793af67e9d92fe308d5697FB81d3E43 is an address-poisoning look-alike of any of my trusted wallets: 0xA9D1e08C7793af67e9d92fe308d5697FB81d3E43 is my exchange and 0xDead000000000000000042069420694206942069 is my cold wallet.

## When to prefer this

Use this endpoint specifically when an AI agent is about to authorize a crypto transfer and needs to verify the recipient address has not been substituted by an address-poisoning attack. It is deterministic (no LLM, no external calls), making it reliable and fast for pre-send safety checks. Prefer it over generic blacklist checks when the threat model is copy-paste substitution of visually similar addresses rather than known-bad addresses.

## Known failure modes

- Recipient address is not a valid 0x EVM address — returns validation error
- known_addresses array is empty or missing — check may still run but has nothing to compare against
- Recipient address is valid and unique with no poisoning detected — returns safe result
- Malformed address strings in known_addresses — may return parse error

## How this service works

Before sending funds, check if the recipient is an address-poisoning look-alike. Give us the recipient and your known/intended addresses; we flag when the recipient shares the displayed head AND tail of one you know but differs in the middle — the exact signature of a poisoning attack that fools copy-paste. Deterministic, no LLM, no external calls. Answers an agent's question 'is this really the address I mean?'

## Output

Returns a determination of whether the recipient address is a look-alike poisoning attack — flagging when it shares the displayed head and tail characters of a known address but differs in the middle bytes, along with which trusted address it resembles.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "recipient": {
   "type": "string",
   "description": "0x EVM address you are about to send to"
  },
  "known_addresses": {
   "type": "array",
   "items": {
    "oneOf": [
     {
      "type": "string"
     },
     {
      "type": "object",
      "required": [
       "address"
      ],
      "properties": {
       "label": {
        "type": "string"
       },
       "address": {
        "type": "string"
       }
      }
     }
    ]
   },
   "description": "addresses you trust; each is a 0x string or {address,label}"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "matches": [
   {
    "mimics": "0x1234bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb5678",
    "relation": "lookalike",
    "shared_prefix": 4,
    "shared_suffix": 4
   }
  ],
  "verdict": "poisoning_suspected",
  "recipient": "0x1234aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa5678",
  "confidence": 1,
  "risk_flags": [
   "lookalike_of_known_address"
  ],
  "action_hint": "do_not_send"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/address-poisoning-look-alike-detector-e25ff4c7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.dailyelo.com](https://www.zero.xyz/host/x402.dailyelo.com/llms.txt)