Developer documentation

Threat list

The list the Pavoriz Shield extension caches to flag phishing hosts and malicious addresses. It is the bundled list that ships with the app, plus the host of every live high risk security alert.

Parameters

No parameters.

Good to know

• Only high risk alerts join the host list. Medium and low alerts are available from /api/alerts.
• It still answers when the database is unreachable: the bundled list goes out on its own and source reads bundled instead of bundled+alerts.
• The bundled list is small. The large public blocklists Pavoriz reads are not served here; ask about a specific host or address with /api/shield/lookup.
• updatedAt is the time the response was generated.

curl https://pavoriz.com/api/shield/threats

{
  "version": 1,
  "updatedAt": "2026-09-30T12:00:00.000Z",
  "addresses": ["0x0000000000000000000000000000000000000000"],
  "hosts": ["uniswop.org", "pancakeswap-finance.com", "opensea-mint.com"],
  "source": "bundled+alerts"
}

Response headers: Access-Control-Allow-Origin: *, Cache-Control: public, max-age=300

Host and address lookup

Checks hosts and wallet addresses against the public threat feeds Pavoriz syncs (MetaMask, ScamSniffer and PhishFort lists).

Parameters

hostquery, optional

A host or URL. Repeat the parameter or separate values with commas. The scheme, path, port and a leading www. are removed; localhost, IP addresses and single labels are dropped.

addressquery, optional

A wallet or contract address: 0x followed by 40 hex characters (compared lowercased), or a base58 address of 32 to 44 characters (compared as written). Anything else is dropped. Repeatable and comma separated, like host.

Good to know

• At least one valid host or address is required.
• Each list is capped at 20 values per request; the rest are ignored. checked echoes what was actually looked up.
• A host is matched exactly as normalized. A parent domain is not looked up for you, so ask for it separately if you need it.
• verdict is listed when a feed Pavoriz names publicly carries the value, and feeds names those feeds. It is watch when only feeds Pavoriz does not name publicly carry it, and feeds is then empty.
• An empty matches array means none of the feeds carry the value. It is not a statement that a site or address is safe.

curl "https://pavoriz.com/api/shield/lookup?host=uniswop.org&address=0x0000000000000000000000000000000000000000"

{
  "ok": true,
  "checked": {
    "hosts": ["uniswop.org"],
    "addresses": ["0x0000000000000000000000000000000000000000"]
  },
  "matches": [
    {
      "value": "uniswop.org",
      "kind": "host",
      "verdict": "listed",
      "feeds": ["MetaMask eth-phishing-detect"]
    }
  ]
}

Response headers: Access-Control-Allow-Origin: *, Cache-Control: public, max-age=3600

Errors

• 400No valid host or address survived normalizing.
  { "ok": false, "error": "Nothing to look up." }
• 503The deployment has no database connection. This is not an empty result.
  { "ok": false, "error": "Not available.", "matches": [] }
• 500The lookup failed. This is not an empty result.
  { "ok": false, "error": "Not available.", "matches": [] }

Security alerts

The dApps Pavoriz is currently warning about: the same live alerts shown on the home page card. Silenced alerts are not returned.

Parameters

No parameters.

Good to know

• Sorted worst risk first (high, medium, low), then most recently raised.
• host is the flagged site. link is the real project's site when the flagged host impersonates one, and can be an empty string.
• icon is a URL or null. source is one of reports, feed, manual or scan.
• reportCount counts incident reports linked to the alert. live is always true in this response.

curl https://pavoriz.com/api/alerts

{
  "ok": true,
  "alerts": [
    {
      "id": "6f1c2b1e-0c4d-4d57-9a53-2c1f7f0e5a10",
      "dappName": "uniswop.org",
      "host": "uniswop.org",
      "link": "https://app.uniswap.org",
      "icon": null,
      "risk": "high",
      "reason": "Clone of the Uniswap interface that asks for unlimited approvals.",
      "source": "manual",
      "reportCount": 0,
      "live": true,
      "raisedAt": "2026-09-01T10:00:00.000Z",
      "updatedAt": "2026-09-01T10:00:00.000Z"
    }
  ]
}

Errors

• 503The deployment has no database connection.
  { "ok": false, "error": "The database is not configured on this deployment." }
• 500The read failed. The detail is logged on the server, not returned.
  { "ok": false, "error": "Something went wrong on our side." }

Exploits

Published exploit incidents, newest first. Most come from DefiLlama's public hacks index; the rest are entered by Pavoriz.

Parameters

limitquery, optional

How many to return. Default 60, clamped to 1 to 500.

Good to know

• occurredOn is a date (YYYY-MM-DD). source is defillama or manual.
• amountUsd and returnedUsd are null when no figure was published. Null is not zero.
• chains uses the publisher's own chain names. link is often an empty string, because the index carries no source link.
• attackers counts attacker addresses Pavoriz has attached to the incident, and affected counts distinct addresses seen sending tokens to them. scannedAt is null when that walk has never run, in which case both counts say nothing yet.

curl "https://pavoriz.com/api/exploits?limit=1"

{
  "ok": true,
  "exploits": [
    {
      "id": "b7a0d7c2-5f7e-4c1a-8d0e-1e9f3c2a4b61",
      "source": "defillama",
      "sourceKey": "Example Protocol|1789171200|12000000|Ethereum",
      "name": "Example Protocol",
      "occurredOn": "2026-09-12",
      "classification": "Protocol Logic",
      "technique": "Price oracle manipulation",
      "amountUsd": 12000000,
      "returnedUsd": null,
      "chains": ["Ethereum"],
      "targetType": "DeFi Protocol",
      "bridgeHack": false,
      "link": "",
      "description": "Example Protocol is listed in DefiLlama's hacks index as a defi protocol incident on Ethereum. The technique was recorded as price oracle manipulation.",
      "published": true,
      "attackers": 0,
      "affected": 0,
      "scannedAt": null
    }
  ]
}

Errors

• 503The deployment has no database connection.
  { "ok": false, "error": "Not available.", "exploits": [] }
• 500The read failed.
  { "ok": false, "error": "Not available.", "exploits": [] }

Wallet check

Checks one wallet address: whether a threat feed names it, and whether it has sent tokens to an address a feed names.

Parameters

addressquery, required

One address: 0x followed by 40 hex characters, or a base58 address of 32 to 44 characters.

Good to know

• verdict is one of listed (a feed names this address), affected (it sent tokens to a listed address), exposed (it holds a live approval to one), clear or unknown.
• clear means the feeds Pavoriz reads do not name the address and nothing Pavoriz has scanned links it to one. It is not a promise that the address is safe.
• unknown means a lookup did not complete, so there is no result.
• sentTo lists up to 25 transfers, with the transaction hash when one was recorded. It is what was observed on chain, not proof of a theft.
• The approvals lookup only runs for a signed in Pavoriz account, so for API callers riskyApprovals is always empty and scannedApprovals is false. exposed therefore does not occur.

curl "https://pavoriz.com/api/exploits/check?address=0x0000000000000000000000000000000000000000"

{
  "ok": true,
  "check": {
    "address": "0x0000000000000000000000000000000000000000",
    "listedBy": ["ScamSniffer scam-database (addresses)"],
    "sentTo": [
      {
        "attacker": "0x...",
        "chain": "ethereum",
        "transfers": 2,
        "txHash": "0x..."
      }
    ],
    "riskyApprovals": [],
    "complete": true
  },
  "verdict": "listed",
  "scannedApprovals": false
}

Errors

• 400The address parameter is missing or empty.
  { "ok": false, "error": "No address was given." }
• 400The value is not an EVM or base58 address.
  { "ok": false, "error": "That is not an address." }
• 503The deployment has no database connection.
  { "ok": false, "error": "The database is not configured on this deployment." }
• 500The read failed. The detail is logged on the server, not returned.
  { "ok": false, "error": "Something went wrong on our side." }

Popular dApps

The dApps opened most often through Pavoriz Shield, with a session count each, and one summed row for everything else.

Parameters

limitquery, optional

How many dApps to list. Default 5, clamped to 1 to 20. Send a whole number.

Good to know

• Counts are all time sessions that the Shield recorded and a Pavoriz page mirrored to the server. They are not the dApp's own user numbers.
• icon is a path on pavoriz.com for dApps Pavoriz ships art for, and null otherwise. name falls back to the host.
• others sums every dApp that did not make the list.

curl "https://pavoriz.com/api/dapps/popular?limit=2"

{
  "ok": true,
  "top": [
    {
      "host": "app.uniswap.org",
      "name": "Uniswap",
      "icon": "/images/activity-icons/uniswap-white.svg",
      "url": "https://app.uniswap.org",
      "sessions": 42
    },
    {
      "host": "example-dapp.xyz",
      "name": "example-dapp.xyz",
      "icon": null,
      "url": "https://example-dapp.xyz",
      "sessions": 17
    }
  ],
  "others": { "dapps": 12, "sessions": 31 }
}

Errors

• 503The deployment has no database connection.
  { "ok": false, "error": "The database is not configured on this deployment." }
• 500The read failed. The detail is logged on the server, not returned.
  { "ok": false, "error": "Something went wrong on our side." }