passlisted in Coinbase#3 by calls of 4 on this host
0.02 USDC
per call, as the listing declares it on eip155:
- Validation state
- pass
- Uptime, 7 / 30 / 90 days
- 100% / 100% / 100%
- Calls, trailing 30 days
- 1
- Unique payers, trailing 30 days
- 1
- Last called
- 2026-10-10 16:02 UTC
- First observed by TOLLderived
- 2026-10-10
- Pricederived
- 0.02 USDC
- Networks
- 1
How big is this endpoint among the ones like it?
No trace is drawn of this endpoint’s own volume. Its counters have changed 1 time across 8 observations, and 3 changes are the fewest this site will draw a trace through, because two points and a guess are not a series. Every observation is in the JSON.
TOLL first observed it on 2026-10-10.
group is a GET endpoint at api.ransomware-tracker.com, listed in the Coinbase registry and filed by TOLL under search.
group is priced at 0.02 USDC on Base.
The request to group is the query parameter name.
The daily sweep got a valid payment challenge from group on 2026-10-24, as at every sweep since 2026-10-10.
group returns json; the example shows group, label and recent_sample.
Of api.ransomware-tracker.com's 4 listings, group ranks tied 3rd by calls with 1 other.
group takes 17% of the calls counted across api.ransomware-tracker.com.
In the trailing 30 days: one call, one payer.
group was last called 3 days before the snapshot.
Closest in price to group within search: seats aero search at stabletravel.dev and reddit search at stableenrich.dev.
Among comparable prices in search, group sits above 77% of them.
The payee wallet is shared by 23 listings across 11 hosts.
The seller's tags on group are ransomware, threat-intelligence, leak-site and cybersecurity.
196 other listings in search declare exactly the same price.
the payment options, as of 2026-10-13 14:08 UTC · method · pinnable
| registry | network | asset | amount | scheme | pay to |
|---|---|---|---|---|---|
| Coinbase | eip155: | USDC | 0.02 USDC | exact | 0x2dAF65…7D65dD |
the checks, as of 2026-10-24 20:57 UTC · method · pinnableendpoint answered HTTP 402
No named check failed.
Every sweep that observed this endpoint, newest first.
| observed, UTC | state | failed checks | sweep |
|---|---|---|---|
| 2026-10-24 20:57 UTC | pass | 0 | daily-2026-10-24 |
| 2026-10-23 06:07 UTC | pass | 0 | daily-2026-10-23 |
| 2026-10-22 04:21 UTC | pass | 0 | daily-2026-10-22 |
| 2026-10-21 07:46 UTC | pass | 0 | daily-2026-10-21 |
| 2026-10-20 07:39 UTC | pass | 0 | daily-2026-10-20 |
| 2026-10-19 05:50 UTC | pass | 0 | daily-2026-10-19 |
| 2026-10-18 08:04 UTC | pass | 0 | daily-2026-10-18 |
| 2026-10-17 18:05 UTC | pass | 0 | daily-2026-10-17 |
| 2026-10-16 04:19 UTC | pass | 0 | daily-2026-10-16 |
| 2026-10-15 05:52 UTC | pass | 0 | daily-2026-10-15 |
| 2026-10-14 04:17 UTC | pass | 0 | daily-2026-10-14 |
| 2026-10-13 08:42 UTC | pass | 0 | daily-2026-10-13 |
| 2026-10-12 06:07 UTC | pass | 0 | daily-2026-10-12 |
| 2026-10-11 04:30 UTC | pass | 0 | daily-2026-10-11 |
| 2026-10-10 21:44 UTC | pass | 0 | new-after-daily-2026-10-10 |
Presence in a registry, not liveness of the service (method). Newest first.
- listed in Coinbase
From the registry record, not validated by TOLL.the declared schema, as of 2026-10-10 16:02 UTC · method · live
The input and output block
{
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"name": "akira"
}
},
"output": {
"type": "json",
"example": {
"group": {
"name": "akira",
"aliases": [],
"first_observed_by_ransomlook": "2023-04-29T15:32:05.000Z"
},
"label": "unverified claim from a criminal leak site",
"recent_sample": {
"claims": [
{
"group": "akira",
"label": "unverified claim from a criminal leak site",
"sector": "Technology",
"country": "United States",
"sources": [
{
"url": "https://www.ransomlook.io/",
"name": "RansomLook",
"license": "CC BY 4.0",
"license_url": "https://creativecommons.org/licenses/by/4.0/"
}
],
"website": "example.com",
"organization": "example.com",
"first_observed_at": "2026-09-01T03:10:00Z",
"claimed_published_at": "2026-09-01T00:00:00Z"
}
],
"claim_count": 1
}
}
}
}Cite this page
The pinned URL below renders this page from the snapshot of 2026-10-13 14:08 UTC and does not change; the live page does, every six hours. Data reuse is under CC BY 4.0 (terms).
Plain text
TOLL, "group on api.ransomware-tracker.com", snapshot of 2026-10-13 14:08 UTC. https://tollindex.com/e/api-ransomware-tracker-com-v1-group-1435dd/at/2026-10-13T14-08Z. Accessed [access date].
BibTeX
@misc{toll-e-api-ransomware-tracker-com-v1-group-1435dd-2026-10-13T14-08Z,
author = {TOLL},
title = {group on api.ransomware-tracker.com},
howpublished = {\url{https://tollindex.com/e/api-ransomware-tracker-com-v1-group-1435dd/at/2026-10-13T14-08Z}},
year = {2026},
month = {10},
note = {Pinned view of the snapshot of 2026-10-13 14:08 UTC. Accessed [access date].}
}None yet. Anything submitted through the form below is published here with its outcome.