← All endpoints
api.polyform.org threat scanners
https://api.polyform.org/v1/threat/scanners
answers 402
Recent IPs caught probing Polyform's honeypot paths (credential/vuln scanners) — Polyform's own first-party telemetry, not a repackaged public list. Returns up to 500 most-recent scanner IPs with first-seen. For blocklists and threat research. JSON.
We sent a real
GET request to this endpoint and it
answered 402 with payment requirements we could parse.
- Price
- $0.01
- Network
- base
- Pay to
- 0xE9468282B22c09243Ce1a455fE2d1DF0d7276dE6
- Spec dialect
- v2 (declares x402Version 2)
- Transport
- PAYMENT-REQUIRED header
- HTTP method
- GET
- Response latency
- 653 ms
- Payment options
- 1 usable of 1
- Last checked
- 2026-09-06T01:13:06.444Z (2h ago)
- Category
- finance-crypto
Re-check it yourself:
curl "https://api.the402.dev/validate?url=https%3A%2F%2Fapi.polyform.org%2Fv1%2Fthreat%2Fscanners"