01
Collect
Candidates in
Domains and addresses arrive from public reports. Nothing is listed on arrival.
Cover still. Smoked glass, brass markers, a hardware wallet.
Wallet hygiene, kept in one place
Take back the approvals you forgot.
A token approval stays live long after you close the tab. Northmark puts every grant next to a blocklist of drainer domains and addresses, so the risky rows are obvious before another signature.
Sample corpus · October 2026 · No wallet connection
Sample feed
An allowance you stopped thinking about is still an open door. I want that door listed, not implied.
Give me the spender, the age, and whether it matches a known exploit. The decision takes a minute.
In an incident, the useful move is a queued revoke a signer can confirm. Not another tour of the interface.
Figures describe the sample corpus shipped with this page. They are not a live customer count.
86Networks modeled
128Exploit signatures
1,240Domains in the sample list
640Addresses in the sample list
The desk
Allowances and scams, on the same sheet.
Six jobs, one record. Nothing on this page connects a wallet or asks for a seed phrase.
- 01
Approval desk
Every grant in one view: token, spender, allowance, age, and network. Unlimited rows sort to the top.
- 02
Exploit match
Allowances are compared with signatures in the sample exploit set. A match is a flag, not a transaction.
- 03
Confirmed revoke
Risky rows can be queued. You confirm each one in your own wallet. This page never signs.
- 04
Domain blocklist
Candidate hosts are checked before they are listed. The feed on this page uses reserved .invalid names.
- 05
Address screen
Spenders and recipient addresses are checked against the same corpus, one by one or as a batch.
- 06
Public notes
Short notes on how drainer families behave, written so a reviewer can cite them without a call.
The path
From a first sighting to a list you can cite.
Every surface reads the same verified rows. The sample set on this page is fixed, so the shape of the work stays visible.
02
Verify
A person on the unclear ones
Automated checks run first. If the call is close, a reviewer holds the row.
03
Deliver
Desk, lookup, file
Verified rows reach the desk, the lookup, and a file you can download and diff.
Readers
Kept open by the people who sign.
Wallet teams
Check a link against the domain list before a person opens it inside the wallet.
Security platforms
Fold the lists into detection and alerting you already run.
Review desks
Screen an address while the case is still on the table.
Method
Three moves. Then the allowance is closed.
1
Paste
Type an address or a host. Nothing is connected, and no wallet is asked to wake up.
2
Read
Sort by network, age, or unlimited allowance. Exploit matches stay visually loud.
3
Revoke
Mark what you no longer use. A real revoke is confirmed in your wallet, not on this page.
Lookup
Ask the list. Get BLOCKED or CLEAR.
One lookup for a domain or an address. This page answers only from the sample corpus in your browser.
- Domain and host checks, one at a time
- Address checks against the same sample
- A status you can read without a dashboard
Example request. The host is reserved and the response is illustrative.
curl "https://lookup.northmark.example/v1/site?host=claim-sample.invalid" \
-H "authorization: Bearer $NORTHMARK_KEY"{
"host": "claim-sample.invalid",
"status": "BLOCKED",
"kind": "drainer",
"corpus": "sample"
}
Notes
Written so they can be cited.
What an unlimited allowance permits
The spender can move the token later, up to the allowance, without a fresh signature from you.
How a host gets onto the sample list
A candidate is collected, checked, and only then delivered. Arrival alone is not enough.
Why disconnect is not a revoke
Disconnecting hides your address from a site. The allowance remains until it is revoked or it expires.
Plans
Start on one network. Widen the desk when it earns it.
Prices describe the product. This page does not bill, and it does not take a payment.
Field
Free
One network
- Single-network sample desk
- Exploit match on that network
- Lookup, 30 checks a day
Most chosen
Signal
$79
per year
- Multi-network desk
- Batch review
- Lookup with a higher daily cap
Closest watch
Ward
$149
per year
- Continuous watch
- Queued revokes you confirm
- A monthly gas note for those confirms
Questions
Before the first revoke.
Can Northmark recover stolen assets?
No. It is a preventative desk. Revoking an allowance can stop later spends through that grant. It cannot pull funds back.
Does a hardware wallet block approval exploits?
No. A hardware wallet protects the key. An approval lets a spender move tokens without a new signature from that key. The device does not cancel old grants by itself.
Is disconnecting a site enough?
No. Disconnecting hides your address from that site. The allowance stays on the chain until it is revoked or it expires.
What if incoming funds disappear at once?
That pattern usually means the seed is already compromised, not only that an approval is open. Revoking will not repair the wallet. Move to a new wallet that has never seen that seed.
What does BLOCKED mean here?
The host or address is in the sample corpus bundled with this page. It is not a live verdict from a production network.
Do you store the address I paste?
The sample lookup runs in your browser. The value is not sent to a server, because this static page does not have one.