{"api":"v1","generated_at":"2026-09-16T02:02:46.745Z","licence":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/","attribution":"TOLL, with a link to the page cited"},"page":"https://tollindex.com/e/netz-halowerk-com-v1-hijack-suspicion-ea4996","pinned_page":"https://tollindex.com/e/netz-halowerk-com-v1-hijack-suspicion-ea4996/at/2026-09-15T21-20Z","pinned":false,"method":"https://tollindex.com/ledger/method","snapshot_at":"2026-09-15T21:20:12.737Z","snapshot_stamp":"2026-09-15T21-20Z","endpoint":{"slug":"netz-halowerk-com-v1-hijack-suspicion-ea4996","canonical_url":"https://netz.halowerk.com/v1/hijack-suspicion","resource":"https://netz.halowerk.com/v1/hijack-suspicion","http_method":"POST","type":"http","x402_version":2,"registries":[],"primary_registry":"cdp","curated_by_coinbase":false,"description":"Collects the observable signs of a route hijack for one prefix and reports which of them are present, with the measurement behind each. Four signs carry different weight. RPKI invalidity is the only hard one: a ROA exists and does not authorise this announcement. An origin AS that appears in the current state but nowhere in the history window is the classic sign, and the response gives the historical origins so the change can be dated.","service_name":null,"declared_category":null,"declared_tags":[],"route_template":null,"registry_updated":"2026-08-11T20:23:43.056Z"},"derived":{"note":"fields no registry supplies; TOLL derives them and marks them derived on the page","title":"hijack suspicion","category":"other","first_observed_by_toll":"2026-09-10T19:08:24.178Z","last_observed_by_toll":"2026-09-10T20:14:11.588Z","observation_began":"2026-09-10"},"presence":{"listed_now":false,"first_absent_at":"2026-09-11T08:47:35.343Z","delisting_confirmed_at":"2026-09-11T09:22:40.554Z","events":[{"registry":"cdp","at":"2026-09-10T19:08:24.178Z","event":"listed"},{"registry":"cdp","at":"2026-09-11T08:47:35.343Z","event":"delisted"},{"registry":"cdp","at":"2026-09-11T09:22:40.554Z","event":"delisting_confirmed"}]},"accepts":[{"registry":"cdp","ordinal":0,"network":"eip155:8453","asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","asset_name":"USD Coin","symbol":"USDC","decimals":6,"amount_display":"0.006 USDC","amount_units":0.006,"decimals_known":true,"pay_to":"0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E","scheme":"exact"}],"counters":{"observed_at":"2026-09-10T20:14:11.589Z","calls_30d":1,"unique_payers_30d":1,"last_called_at":"2026-08-11T20:23:42.559Z"},"validation":{"latest":null,"uptime":[{"days":7,"observed":0,"passed":0,"ratio":null},{"days":30,"observed":0,"passed":0,"ratio":null},{"days":90,"observed":0,"passed":0,"ratio":null}],"history_90d":[]},"seller":{"wallet":"0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E","page":"https://tollindex.com/seller/0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E","endpoints":1553,"hosts":67},"reports":0,"registry_record":{"cdp":[{"type":"http","accepts":[{"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","asset":"USDC","version":"2","eip712Domain":{"name":"USD Coin","chainId":8453,"version":"2","verifyingContract":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"},"network_name":"Base Mainnet","assetTransferMethod":"eip3009"},"payTo":"0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E","amount":"6000","scheme":"exact","network":"eip155:8453","maxTimeoutSeconds":300}],"quality":{"lastCalledAt":"2026-08-11T20:23:42.559Z","l30DaysTotalCalls":1,"l30DaysUniquePayers":1},"resource":"https://netz.halowerk.com/v1/hijack-suspicion","extensions":{"bazaar":{"info":{"input":{"body":{"prefix":"8.8.8.0/24","expected_asn":"AS15169","history_days":30},"type":"http","method":"POST","bodyType":"json"}},"schema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["prefix"],"properties":{"prefix":{"type":"string","maxLength":60,"minLength":4},"expected_asn":{"type":"string","maxLength":15,"description":"The AS you expect to announce this prefix. Supplying it turns a general check into a targeted one."},"history_days":{"type":"integer","default":30,"maximum":180,"minimum":1}},"additionalProperties":false},"type":{"type":"string","const":"http"},"method":{"enum":["POST","PUT","PATCH"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false}}}}},"description":"Collects the observable signs of a route hijack for one prefix and reports which of them are present, with the measurement behind each. Four signs carry different weight. RPKI invalidity is the only hard one: a ROA exists and does not authorise this announcement. An origin AS that appears in the current state but nowhere in the history window is the classic sign, and the response gives the historical origins so the change can be dated.","lastUpdated":"2026-08-11T20:23:43.056Z","x402Version":2}]}}