address-poison-check

Before sending funds, check if the recipient is an address-poisoning look-alike. Give us the recipient and your known/intended addresses; we flag when the recipient shares the displayed head AND tail of one you know but differs in the middle — the exact signature of a poisoning attack that fools copy-paste. Deterministic, no LLM, no external calls. Answers an agent's question 'is this really the address I mean?'

Call it in 30 seconds

// npm i x402-fetch viem
import { wrapFetchWithPayment } from "x402-fetch";
import { createWalletClient, http } from "viem";
import { privateKeyToAccount } from "viem/accounts";
import { base } from "viem/chains";

const account = privateKeyToAccount(process.env.PRIVATE_KEY); // funds USDC on Base
const wallet = createWalletClient({ account, chain: base, transport: http() });
const fetchWithPay = wrapFetchWithPayment(fetch, wallet);

// Pays the $0.005 USDC automatically on the 402, then returns the real response:
const res = await fetchWithPay("https://x402.dailyelo.com/v1/address-poison-check", { method: "POST" });
console.log(await res.json());

# pip install x402 eth-account httpx
import os, asyncio
from eth_account import Account
from x402.clients.httpx import x402HttpxClient

account = Account.from_key(os.environ["PRIVATE_KEY"])  # funds USDC on Base

async def main():
    async with x402HttpxClient(account=account) as client:
        # x402 handles the 402 -> pay ($0.005 USDC) -> retry automatically
        r = await client.get("https://x402.dailyelo.com/v1/address-poison-check")
        print((await r.aread()).decode())

asyncio.run(main())

# 1) An unpaid request returns HTTP 402 with the exact payment terms:
curl -i -X POST "https://x402.dailyelo.com/v1/address-poison-check" \
  -H 'content-type: application/json' \
  -d '{"known_addresses": ["0x1234bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb5678", {"address": "0x9999cccccccccccccccccccccccccccccccc0000", "label": "exchange deposit"}], "recipient": "0x1234aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa5678"}'

# 2) Paying + retrying requires an x402 client that can sign the USDC
#    authorization (curl alone cannot). See the JS / Python tabs below.

New to x402? Read the 5-minute quickstart →