The radar

What the network learned today, as a page, a tab in the app, and a JSON endpoint. Names the swarm confirmed, how the lists grew, and the brands the new names impersonate, built from swarm flags and list refreshes and never from lookups.

PayHole blocks a name on every phone and browser running it the moment the network learns about it. Until now the learning was invisible: a node knew, the swarm knew, and nobody could see it happen. The radar makes it visible.

What it shows

• Swarm confirmations. How many names the swarm confirmed in the last 24 hours and the last 7 days, the newest twenty with their category and how many reporters agreed, and how many are flagged and still waiting for enough agreement.
• List growth. Each subscribed list with the names it gained and lost in the last 24 hours and a sample of the new ones. On the public resolver that is ScamSniffer, Phishing.Database, and StevenBlack, about 815,000 names in all.
• New names by kind. Drainer infrastructure, wallet drainers, phishing, counterfeit token sites, trackers, ads.
• Brands impersonated. The brands the new names trade on, most often first, with examples. metamask-verify on a free hosting platform counts for MetaMask; metamask.io does not, because a brand's own name is never impersonation.

Where it lives

• payhole.org/radar.html, which reads the endpoint from the page.
• The Radar tab in PayHole for Android 0.3, which replaces the Lists tab and keeps the list cards underneath.
• https://dns.payhole.org/radar, JSON any wallet, exchange, or dashboard may read. It is rebuilt once a minute, cacheable for a minute, open to any origin, and shares the resolver's rate limit. Every Sinkhole node serves its own at /api/radar.

Where it does not come from

The public resolver keeps no query log, and the radar does not need one. It is built from two things a node already has: the flags it received from the swarm and the lists it refreshes. Nodes now remember the last 500 confirmations and the last twelve changing refreshes per list, with the names each one gained. A refresh with no earlier copy of the list to compare against records nothing, so a fresh node shows quiet lists until its second refresh. The public node was updated today, so its first day will fill in as the lists move.

What comes next

The same snapshot, sold over x402 to wallets and exchanges as a feed, paid in USDG, with the operators' share going to the nodes that reported and the protocol's share buying and burning the token. The radar you can read for free is the product; the feed is the same product with a receipt.