TAtatum
Security API

Check malicous address

Changed on

/v3/security/address/{address}

1 credit per API call.

Check, if the blockchain address is malicous. Malicous address can contain assets from the DarkWeb, is connected to the scam projects or contains stolen funds.

We use malicious address data from standard on-chain analytics providers for this endpoint, together with the digital currency addresses published on the OFAC SDN list (US Treasury sanctions). The API response includes the source used.

The check is done by address, not by chain. The address is matched against all our sources, whichever chain it belongs to, and is reported as invalid when it appears in any of them. BTC and LTC addresses are additionally scored by a live risk provider; when that provider cannot be reached the address is reported as invalid rather than cleared.

valid means the address was not found in our sources, not that it has been cleared by every provider. An address that is neither listed nor in a recognised address format is rejected with 400 security.unknown.address.

get/v3/security/address/{address}

Request

  • Base URL
    https://api.tatum.io
  • URL
    https://api.tatum.io/v3/security/address/{address}
  • Auth
    API key in header x-api-key

Path parameters

addressstring required
Example:0x002Bf459dC58584D58886169EA0E80f3Ca95FFAF

Blockchain Address to check

Response

OK

status'valid' | 'invalid'

Whether address is malicous or not

addressstring

Wallet address

sourcestring

Source of the data (for example CryptoScamDB, Hackbounty, OFAC)

descriptionstring

Why this address is malicious

categorystring

Category assigned by the source, when the source provides one

urlstring

Link to the source record, when the source provides one

Example response

{
  "status": "valid",
  "address": "0x002Bf459dC58584D58886169EA0E80f3Ca95FFAF",
  "source": "CryptoScamDB",
  "description": "Trust trading scam site",
  "category": "OFAC SDN",
  "url": "https://sanctionssearch.ofac.treas.gov/Details.aspx?id=40000",
  "sanctions": {
    "list": "SDN",
    "uid": 40000,
    "entity": "GARANTEX EUROPE OU",
    "entityType": "Entity",
    "programs": [
      "CYBER2",
      "RUSSIA-EO14024"
    ],
    "symbol": "ETH",
    "aliases": [
      "GARANTEX"
    ],
    "remarks": "(Linked To: FEDERAL SECURITY SERVICE)",
    "listedAt": "2022-04-05",
    "legalBasis": [
      "Executive Order 14024 (Russia)",
      "Executive Order 14306 (Cyber)"
    ],
    "measures": [
      "Block"
    ],
    "reliability": "Unknown",
    "comment": "This address is also associated with BCH and BSV forks.",
    "relationships": [
      {
        "type": "Acting for or on behalf of",
        "entity": "Pavel Karavatsky",
        "uid": 53077,
        "direction": "from"
      }
    ]
  }
}

Changes

  • 1a87afa0f639Revision changes
    • info

      api tag Security API added

    • info

      api tag Malicious address removed

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status