2025 report: crypto phishing losses fall 83% to $84M Read →

Scam and theft intelligence for crypto teams

Scam Sniffer finds scam and malware sites, monitors Ethereum for thefts and exploits, and lists the addresses behind them. Wallets, exchanges, and security platforms query the same data over our API.

Contact sales Get the free extension

Read the API docs

try

420K+ domains · 61K+ addresses · Ethereum monitored block by block

Queried by wallets, exchanges & security teams

Sites, addresses, and on-chain activity

Large-scale scanning finds scam infrastructure, on-chain monitoring finds the addresses behind thefts and exploits, and every entry is verified before it ships.

Malicious domains: 420K+; Wallet drainers, seed-phrase stealers, malware downloads, fake investment and token-sale sites, and hijacked dapp frontends, found by scanning tens of millions of URLs and new domains as they appear. Pages are checked by their content, not only their name.
Malicious addresses: 61K+; Drainer operator wallets, malicious contracts, and exploiter addresses. Where known, an entry says who it belongs to, such as a drainer family or an exploit.
On-chain monitoring: Ethereum; Each block is checked for wallet drains, key compromises, address poisoning, protocol exploits, and laundering after an attack. See recent alerts

Where teams use the data

Team

What they do with it

Endpoints

Wallets & extensions

Check a link or a recipient address before the user signs or sends. Warn on scam sites and drainer contracts, and show the address label in the warning.

site check
address check

Exchanges, bridges & stablecoin issuers

Screen deposit and withdrawal addresses against drainer and exploiter addresses. Batch-check addresses during review, and get the label and source transaction where known.

address check
address resolver

Security & compliance platforms

Merge the feed into your own detection, tracing, and case work, with bulk exports and labels and categories for triage.

blocklist export
data license

API

Look up a domain or address, get the verdict and the context

Lookups return BLOCKED or PASSED. Where we know more, the address resolver adds the label, category, and source transaction.

Domain & URL checks, single or batch
Address checks, single or batch
Labels and categories where known (Enterprise)
Blocklist exports for partner integrations

Read the API docs Contact sales

$ curl "$SCAMSNIFFER_API/site/check?url=https://app-sushii-swap.com" \
    -H "x-api-key: $SCAMSNIFFER_KEY"

{
  "url":    "https://app-sushii-swap.com",
  "host":   "app-sushii-swap.com",
  "status": "BLOCKED"
}

$ curl "$SCAMSNIFFER_API/v2/blacklist/domain/byAddress?address=0x8296721489d0a7e934edd66ea27159b1c88a42e5" \
    -H "x-api-key: $SCAMSNIFFER_KEY"

{
  "label":       ["X100 Governance Attacker: Fund Holder"],
  "category":    "exploit",
  "id":          "x100-exploit-2026-10-24",
  "domains":     [],
  "transaction": "0x38c60844f1923d53fdce7d99e9bc2a2d8c73a08e793341dfbb479f8cc74d81d0",
  "chain":       1
}

Recent alerts

Cases from our public alert feed on X, each verified on-chain. Follow @realScamSniffer

August 21, 2026

Address poisoning

A wallet sent $2M in USDC to a lookalike address it copied from its own transfer history.

sent to: 0xF0e6A49668dE1195B931A3717c9cc36fc19721aF
intended: 0xF0e67A1896E814E30c011e36174de28CAA9Ab1aF

lost $2M

Victim wallet Transfer

August 12, 2026

Suspected private key compromise

Two wallets were emptied in 15 minutes. DAI, WBTC, aUSDC, LDO, sUSDe, and ETH all went to a fresh address.

lost ~$25M

Victim wallet First outflow

March 16, 2026

Phishing permit signature

A wallet lost $1.77M in USDC after signing a phishing permit (gasless approval) signature on Ethereum. One transaction moved it all.

lost $1.77M

Victim wallet Drain transaction

Detection finds candidates. Verification decides what ships.

Automated detection is set to catch as much as possible, so it also flags things that turn out to be legitimate. Nothing reaches the blocklist until it has been verified.

01

Detect

Scanners read pages and newly seen domains. On-chain monitors check each Ethereum block. Both produce candidates, not verdicts.
02

Verify

Automated checks first, human review when a case is not clear-cut. Only verified entries are listed.
03

List & correct

Entries carry a label, a category, and the source transaction where known. Reported false positives are reviewed and removed from the blocklists.

Research, published in the open

We publish drainer-family research, victim statistics, and annual reports — free, from the same pipeline that powers the blocklists. Industry media regularly cite them.

Read our research

As cited by