# ChainAnalyzer Address Poisoning Similarity Check

> ChainAnalyzer Address Poisoning Similarity Check is a paid API for AI agents from chain-analyzer.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-10).

Detects whether a destination blockchain address is a lookalike (address-poisoning attack) of any address in a caller-supplied list of trusted addresses, by comparing leading and trailing characters.

## Facts

- Endpoint: GET https://chain-analyzer.com/api/v1/x402/address/:address/poisoning-check?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/chainanalyzer-address-poisoning-similarity-check-91fb39f3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_sunLanG2x5q3lUTSoAoM1

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability chainanalyzer-address-poisoning-similarity-check-91fb39f3
```

Example prompt: Before I send funds, check if 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 is a poisoned lookalike of any of my trusted addresses — 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 and 0xdAC17F958D2ee523a2206206994597C13D831ec7 — on Ethereum.

## When to prefer this

Choose this endpoint when you need an instant, zero-latency check of whether a destination address visually mimics a trusted address — especially before executing a blockchain transfer. It is ideal for pre-flight address validation in wallets, DeFi protocols, or payment agents where speed is critical and no external blockchain scan is needed. Prefer it over full AML screening when the threat model is specifically address-poisoning/substitution attacks rather than sanctions or illicit fund flows.

## Known failure modes

- Missing or malformed destination address returns an error response
- Empty or unparseable 'known' list may result in no comparison being performed
- Unsupported chain identifier may cause a validation error
- Very long 'known' lists may exceed query parameter size limits
- Network timeout or service unavailability returns a non-200 error

## How this service works

Is this destination a lookalike of an address the sender already trusts? Applies the address-poisoning similarity rule (leading and trailing characters that wallet UIs abbreviate to) between one destination and a caller-supplied list of known-good addresses. Pure string comparison when `known` is given, so it answers in milliseconds and never runs a scan.

## Output

Returns whether the destination address matches the leading and trailing characters of any address in the known-good list, indicating a potential address-poisoning attack. Responses are delivered in milliseconds as a pure string comparison with no external scan required.

## Request schema (JSON Schema)

```json
{
 "properties": {
  "input": {
   "properties": {
    "queryParams": {
     "type": "object",
     "properties": {
      "chain": {
       "type": "string"
      },
      "known": {
       "type": "string"
      },
      "address": {
       "type": "string"
      }
     }
    }
   }
  },
  "output": {
   "properties": {
    "example": {}
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/chainanalyzer-address-poisoning-similarity-check-91fb39f3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from chain-analyzer.com](https://www.zero.xyz/host/chain-analyzer.com/llms.txt)