> ## Documentation Index > Fetch the complete documentation index at: https://docs.blockline.sh/llms.txt > Use this file to discover all available pages before exploring further. # Profile a Sandwich Attacker > Analyze a specific attacker's sandwich activity against a victim wallet. Returns statistics: sandwiches by DEX, by validator/client, by pool, timing patterns, and % of victim trades sandwiched. Reuses cached check-wallet data when available. ## OpenAPI ````yaml /api-reference/openapi.json post /mev/check-attacker openapi: 3.0.3 info: title: Blockline MEV Analytics API description: >- Professional MEV analytics API for Solana. Analyze transaction context, detect front-running, identify sandwich attacks, and gain competitive intelligence on Solana MEV activity. version: 1.0.0 contact: name: Blockline Support url: https://blockline.soltop.sh servers: - url: https://api.soltop.sh description: Production API security: - ApiKeyAuth: [] tags: - name: Trade Analysis description: Analyze MEV activity and transaction context - name: Transactions description: Transaction details and metadata - name: Wallets description: Wallet transaction history - name: Data Management description: Backfill and data operations - name: MEV Analysis description: >- Sandwich attack detection: scan wallets, check transactions, and profile attackers (async job queue) - name: Write Locks description: Account write lock contention and hot account analysis paths: /mev/check-attacker: post: tags: - MEV Analysis summary: Profile a Sandwich Attacker description: >- Analyze a specific attacker's sandwich activity against a victim wallet. Returns statistics: sandwiches by DEX, by validator/client, by pool, timing patterns, and % of victim trades sandwiched. Reuses cached check-wallet data when available. operationId: checkAttacker requestBody: required: true content: application/json: schema: type: object required: - attacker_address - victim_address properties: attacker_address: type: string description: Attacker wallet address (from check-wallet results) example: DDm1Bc9KuXB7Q2UbxyMRLGmbcV2J93xmiWDPt7Edhqbs victim_address: type: string description: Victim wallet address example: 8ENw3qJSzWGUV31BW5u2YEmsyp9XKjH1FxuwLhhwwMe2 time_range_days: type: integer default: 1 minimum: 1 maximum: 4 description: Number of days to analyze slot_window: type: integer default: 4 minimum: 0 maximum: 10 description: Slot window (±) for detection responses: '200': description: Job submitted or cached result returned content: application/json: schema: oneOf: - type: object description: Job queued properties: success: type: boolean example: true jobId: type: string status: type: string example: queued message: type: string - type: object description: Cached result properties: success: type: boolean example: true data: type: object properties: attacker_address: type: string victim_address: type: string summary: type: object properties: total_sandwiches: type: integer description: Sandwiches by this attacker total_victim_dex_trades: type: integer description: Total victim DEX trades in range victim_trades_sandwiched_pct: type: number description: '% of victim trades sandwiched by this attacker' total_incidents: type: integer description: Total incident legs (frontrun + backrun) timing: type: object properties: avg_poh_tick_offset: type: integer min_poh_tick_offset: type: integer max_poh_tick_offset: type: integer by_dex: type: array items: type: object properties: dex_name: type: string example: Pump.fun count: type: integer by_validator: type: array items: type: object properties: leader_pubkey: type: string description: Validator public key client_type: type: string description: Validator client (e.g. jito, agave) example: jito count: type: integer by_pool: type: array items: type: object properties: pool_address: type: string pool_label: type: string count: type: integer trades: type: array description: Trades where this attacker sandwiched the victim items: type: object properties: signature: type: string slot: type: integer blockTime: type: integer pools: type: array items: type: object incidents: type: array items: $ref: '#/components/schemas/SandwichIncident' '400': description: Invalid request content: application/json: schema: $ref: '#/components/schemas/Error' examples: missing_attacker: value: error: Invalid request details: attacker_address is required same_address: value: error: Invalid request details: attacker_address and victim_address must be different '401': $ref: 02ca5649-c9d9-4a5e-8f26-a133d5c61cc5 '403': $ref: 80776eac-c595-4f19-9646-9d6dc9a6cf2c '429': $ref: cfbde83c-0b04-46b0-b46a-c3a713982079 security: - SupabaseJWT: [] components: schemas: SandwichIncident: type: object properties: attacker_signature: type: string description: Attacker's transaction signature attacker_signer: type: string description: Attacker's wallet address slot: type: integer description: Slot of the attacker's transaction poh_tick: type: string description: PoH tick position (BigInt as string) poh_tick_offset: type: string description: PoH tick distance from victim (negative = before) interaction_type: type: string enum: - sandwich_frontrun - sandwich_backrun description: Type of sandwich leg (only sandwich incidents are returned) pool_address: type: string description: DEX pool where the interaction occurred pool_label: type: string description: Human-readable pool label success: type: boolean description: Whether the attacker's transaction executed successfully Error: type: object properties: error: type: string description: Error message details: oneOf: - type: string - type: array items: type: string description: Detailed error information timestamp: type: string format: date-time description: When the error occurred securitySchemes: ApiKeyAuth: type: http scheme: bearer bearerFormat: API Key description: >- API Key authentication. Format: `sk_live_xxx` (production) or `sk_test_xxx` (testing). Obtain your API key from the [Blockline Dashboard](https://blockline.soltop.sh/dashboard/api-keys). SupabaseJWT: type: http scheme: bearer bearerFormat: JWT description: >- Supabase JWT authentication. Used for MEV Analysis and Write Locks endpoints. Requires an active subscription (trial, active, or grace_period status). ````