passlisted in Coinbase#1 by calls of 8 on this host
0.002 USDC
per call, as the listing declares it on eip155:
- Validation state
- pass
- Uptime, 7 / 30 / 90 days
- 100% / 100% / 100%
- Calls, trailing 30 days
- 2
- Unique payers, trailing 30 days
- 1
- Last called
- 2026-08-26 14:49 UTC
- First observed by TOLLderived
- 2026-09-10
- Pricederived
- 0.002 USDC
- Networks
- 1
How big is this endpoint among the ones like it?
No trace is drawn of this endpoint’s own volume. Its counters have changed 1 time across 28 observations, and 3 changes are the fewest this site will draw a trace through, because two points and a guess are not a series. Every observation is in the JSON.
threat ip answers GET requests at api.polyform.org; it is listed in the Coinbase registry and TOLL files it under identity.
threat ip is priced at 0.002 USDC on Base.
Callers of threat ip supply the query parameter ip.
A response from threat ip, as declared, includes ip, score, sources, malicious and observedByPolyform.
threat ip answered the sweep of 2026-09-15 with a valid 402, as at every sweep since 2026-09-11.
threat ip shares api.polyform.org with 7 other listed endpoints and is 1st by calls.
threat ip takes 22% of the calls counted across api.polyform.org.
One payer accounts for all 2 calls to threat ip over 30 days.
threat ip was last called 20 days before the snapshot.
Closest in price to threat ip within identity: verify audit at rubric-protocol.com and aman ens resolve at amanchain-relay.gitajhd.workers.dev.
threat ip is among the cheapest in identity; 9% of comparable listings ask less.
The wallet paid by threat ip is the payee of 23 endpoints across 2 hosts.
Seller tags: data, api, v1 and threat.
The price of threat ip is declared by 79 other listings in identity too.
the payment options, as of 2026-09-15 16:57 UTC · method · pinnable
| registry | network | asset | amount | scheme | pay to |
|---|---|---|---|---|---|
| Coinbase | eip155: | USDC | 0.002 USDC | exact | 0xE94682…276dE6 |
the checks, as of 2026-09-15 05:52 UTC · method · pinnableendpoint answered HTTP 402
No named check failed.
Every sweep that observed this endpoint, newest first.
| observed, UTC | state | failed checks | sweep |
|---|---|---|---|
| 2026-09-15 05:52 UTC | pass | 0 | daily-2026-09-15 |
| 2026-09-14 05:24 UTC | pass | 0 | daily-2026-09-14 |
| 2026-09-13 05:19 UTC | pass | 0 | daily-2026-09-13 |
| 2026-09-12 07:36 UTC | pass | 0 | daily-2026-09-12 |
| 2026-09-11 11:24 UTC | pass | 0 | daily-2026-09-11 |
Presence in a registry, not liveness of the service (method). Newest first.
- listed in Coinbase
From the registry record, not validated by TOLL.the declared schema, as of 2026-08-26 14:49 UTC · method · live
The input and output block
{
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"ip": "IPv4 address to check"
}
},
"output": {
"type": "json",
"example": {
"ip": "45.134.26.5",
"score": 90,
"sources": [
"blocklist.de",
"polyform-observed"
],
"malicious": true,
"observedByPolyform": true
}
}
}Cite this page
The pinned URL below renders this page from the snapshot of 2026-09-15 16:57 UTC and does not change; the live page does, every six hours. Data reuse is under CC BY 4.0 (terms).
Plain text
TOLL, "threat ip on api.polyform.org", snapshot of 2026-09-15 16:57 UTC. https://tollindex.com/e/api-polyform-org-v1-threat-ip-91ffc4/at/2026-09-15T16-57Z. Accessed [access date].
BibTeX
@misc{toll-e-api-polyform-org-v1-threat-ip-91ffc4-2026-09-15T16-57Z,
author = {TOLL},
title = {threat ip on api.polyform.org},
howpublished = {\url{https://tollindex.com/e/api-polyform-org-v1-threat-ip-91ffc4/at/2026-09-15T16-57Z}},
year = {2026},
month = {9},
note = {Pinned view of the snapshot of 2026-09-15 16:57 UTC. Accessed [access date].}
}None yet. Anything submitted through the form below is published here with its outcome.