Daily transfers, volume and coverage →
47-85-47-24.sslip.io · 47-85-47-24.sslip.io · Security
Audit a built-in vulnerable OpenAPI 3.1 contract against deterministic OWASP API Security Top 10 2023 contract-level checks without active scanning
The payout address is also published by 10 other service(s); the volume cannot be attributed to one of them.
| Window | Observed | Transfers |
|---|---|---|
| Last complete day (2026-10-31) | — | — |
| Last 7 days | — | — |
| Last 30 days | — | — |
| Growth, 7d against the 7 before | not comparable | |
Daily history →. Observed transfers show value arriving at the payout address; they do not establish service revenue.
Receiving wallets are payment addresses published for this service. Sending wallets transferred funds to an exclusive receiving address; this alone does not prove a purchase or identify an agent.
| Network | Full wallet address | Evidence |
|---|---|---|
| Base | 0xfe8b1298727706a6d9737c5afbc7af8e76842b91 | Shared address · activity cannot be assigned to this serviceFrom source record · source: payai |
No sending wallet addresses have been retained for this service. Buyer wallets are unknown; daily totals and reported payer counts do not reveal their addresses.
Coverage includes retained scans only, not every historical transaction. Earlier daily totals cannot recover sender addresses. Sender lists exclude shared receiving wallets, whose transfers could belong to another service. A provider address does not establish wallet ownership.
Sorted by source-measured calls, not by our opinion. The right-hand figure is observed inflow, which stays empty for peers whose address is shared.
| With a measured call count | 11,901 (84.3 %) |
|---|---|
| With a published price | 12,186 (86.3 %) |
| With attributable inflows | 32 (0.2 %) |
| Observed inflows · 30d | $929.01 |
| Median measured calls | 2 |
| Median price per call | $0.01 |
Email deliverability & domain security check — validates SPF, DKIM (multi-selector), and DMARC, detects spoofing and misconfigurations, and returns an A–F email security grade with transparent deductions. Anti-spam / ant...
Full website audit in one call: accessibility (WCAG 2.1 A/AA via axe-core), on-page SEO, HTTP security headers and page speed / page weight, from a single browser load of one URL. Cheaper than four separate calls; if any...
CVE vulnerability lookup. Returns security vulnerability records by CVE id or keyword from the NIST National Vulnerability Database and GitHub Security Advisories, each with CVSS score, severity, CWE weakness class, affe...
Smart Contract Audit — Security review of a single contract
Chosen by category and by whether we have measured them, not by who pays us. A sponsored placement in this list is labelled as such.
| Network | Scheme | Amount | Asset |
|---|---|---|---|
| Base | exact | 0.001 | USDC |
“exact” is the price per call. “upto” is a ceiling the client sets, not a price. Atomic amount 1000 = 0.001 USDC per call on Base.
endpoint
https://47-85-47-24.sslip.io/v1/openapi-security
{
"type": "http",
"method": "GET",
"queryParams": {
"scenario": "insecure-admin-contract"
}
}
{
"type": "json",
"example": {
"label": "paid-demo:insecure-admin-contract",
"stats": {
"low": 1,
"high": 5,
"medium": 2,
"critical": 0,
"findings": 8,
"operations": 2,
"security_schemes": 1,
"write_operations": 1,
"remote_references": 0,
"protected_operations": 0,
"anonymous_or_public_operations": 2
},
"profile": "internet",
"summary": "BLOCK: 8 finding(s) across 2 operation(s); 5 high, 2 medium, 1 low.",
"verdict": "BLOCK",
"coverage": {
"rules": [
"authentication and authorization declarations",
"security-scheme transport and flow choices",
"resource bounds for pagination and request bodies",
"sensitive response and privileged input fields",
"deployment transport and API inventory hygiene",
"external reference trust boundaries"
],
"standard": "OWASP API Security Top 10 2023",
"local_refs": true,
"limitations": "A contract cannot prove runtime authorization, rate limiting, input enforcement, or exploitability; verify findings against implementation and gateway policy.",
"active_scanning": false,
"exploit_attempts": false,
"contract_level_only": true,
"remote_refs_fetched": false
},
"findings": [
{
"code": "api_key_in_query",
"summary": "An API key is transmitted in the URL query string.",
"evidence": "Security scheme 'queryKey' uses in=query.",
"location": "$.components.securitySchemes/queryKey",
"severity": "high",
"remediation": "Move credentials to an Authorization or purpose-specific request header.",
"risk_weight": 18,
"owasp_api_2023": "API2:2023 Broken Authentication"
},
{
"code": "sensitive_response_without_required_auth",
"summary": "An unauthenticated success response documents sensitive-looking fields.",
"evidence": "refresh_token",
"location": "$.paths//accounts/get/responses",
"severity": "high",
"remediation": "Require object/property authorization and remove secrets from response schemas.",
"risk_weight": 20,
"owasp_api_2023": "API3:2023 Broken Object Property Level Authorization"
},
{
"code": "write_operation_without_required_auth",
"summary": "A state-changing operation does not require documented authentication.",
"evidence": "Effective security mode is anonymous.",
"location": "$.paths//admin/users/{id}/delete",
"severity": "high",
"remediation": "Require an appropriate security scheme and enforce function-level authorization.",
"risk_weight": 22,
"owasp_api_2023": "API5:2023 Broken Function Level Authorization"
},
{
"code": "privileged_fields_client_writable",
"summary": "Potentially privileged properties are client-writable.",
"evidence": "role",
"location": "$.paths//admin/users/{id}/delete/requestBody",
"severity": "high",
"remediation": "Use allow-listed input DTOs and derive ownership, roles, prices, and status server-side.",
"risk_weight": 17,
"owasp_api_2023": "API3:2023 Broken Object Property Level Authorization"
},
{
"code": "insecure_server_transport",
"summary": "A documented API server uses cleartext HTTP.",
"evidence": "http://api.example.test",
"location": "$.servers/0/url",
"severity": "high",
"remediation": "Use HTTPS with modern TLS for every non-local deployment.",
"risk_weight": 16,
"owasp_api_2023": "API8:2023 Security Misconfiguration"
},
{
"code": "read_operation_without_documented_auth",
"summary": "A read operation has no mandatory documented authentication.",
"evidence": "Effective security mode is undocumented.",
"location": "$.paths//accounts/get",
"severity": "medium",
"remediation": "Declare required authentication or list this operation explicitly as intentionally public.",
"risk_weight": 10,
"owasp_api_2023": "API2:2023 Broken Authentication"
},
{
"code": "unbounded_pagination_parameter",
"summary": "A pagination or result-count parameter has no maximum.",
"evidence": "'limit' is numeric without maximum.",
"location": "$.paths//accounts/get/parameters/query:limit",
"severity": "medium",
"remediation": "Set a conservative schema maximum and enforce the same server-side cap.",
"risk_weight": 7,
"owasp_api_2023": "API4:2023 Unrestricted Resource Consumption"
},
{
"code": "security_schemes_unused",
"summary": "Declared security schemes are not referenced by any operation.",
"evidence": "queryKey",
"location": "$.components.securitySchemes",
"severity": "low",
"remediation": "Remove stale schemes or attach them to the intended global/operation requirements.",
"risk_weight": 3,
"owasp_api_2023": "API9:2023 Improper Inventory Management"
}
],
"operations": [
{
"path": "/accounts",
"method": "GET",
"operation_id": "listAccounts",
"security_mode": "undocumented",
"write_operation": false
},
{
"path": "/admin/users/{id}",
"method": "DELETE",
"operation_id": "deleteUser",
"security_mode": "anonymous",
"write_operation": true
}
],
"risk_score": 100,
"analysis_id": "apisec-cbfa909ee1a1a22f",
"analyzer_version": "apisec-openapi-owasp-2023/1.0",
"remediation_plan": [
"Move credentials to an Authorization or purpose-specific request header.",
"Require object/property authorization and remove secrets from response schemas.",
"Require an appropriate security scheme and enforce function-level authorization.",
"Use allow-listed input DTOs and derive ownership, roles, prices, and status server-side.",
"Use HTTPS with modern TLS for every non-local deployment.",
"Declare required authentication or list this operation explicitly as intentionally public.",
"Set a conservative schema maximum and enforce the same server-side cap.",
"Remove stale schemes or attach them to the intended global/operation requirements."
]
}
}
Examples are the provider's own, not a call we made.
The payout address is shared with 10 other service(s). That is normal for facilitator and platform addresses, and it is why this profile shows no inflow figure. The volume exists — it just cannot be split without inventing a rule.
How attribution works →32 of 14,118 services (0.2%) in Security have attributable inflows; 11,901 have a source-measured call count. Median measured calls: 2.
Rank this category by observed inflows →Audit a built-in vulnerable OpenAPI 3.1 contract against deterministic OWASP API Security Top 10 2023 contract-level checks without active scanning
Quoted from PayAI · source record · read 2026-10-29
Attribution blocked
· confidence low
The payout address is also published by 10 other service(s); the volume cannot be attributed to one of them.
Why revenue is “unknown”. A revenue figure needs a receipt: an amount a buyer actually paid for this service. We hold none for this entry, and we hold no funds at all. What we have instead is nothing measurable: no price, no attributable address, no receipt. The payout address is also published by 10 other service(s); the volume cannot be attributed to one of them.
No daily history has been archived for this service yet. Open the full daily history →
A payment rail is where the provider asks to be paid. It is not proof that anything was paid through it.
One row per statement. “Verified” means we checked it ourselves and the finding is quoted. “Provider claim” means we read it in the provider's own record. “Not found” is a statement about our search, not proof of absence.
| Statement | Status | What we found | Source | Checked |
|---|---|---|---|---|
| Endpoint | Provider claim |
https://47-85-47-24.sslip.io/v1/openapi-security
EvidenceAls Resource-URL im Bazaar-Eintrag geführt. |
facilitator.payai.network | 2026-10-29 |
| Input output | Provider claim |
Request/response examples published with the listing
EvidenceBeispiel-Ein- und -Ausgabe stammen aus dem Bazaar-Eintrag des Anbieters. |
facilitator.payai.network | 2026-10-29 |
| Payment | Provider claim |
1 rail: Base · payee 0xFe8b1298727706A6D9737C5afbC7AF8e76842B91
EvidenceAus den `accepts`-Einträgen: Netzwerk, Asset, Empfängeradresse und Betrag. Die Adresse ist die Grundlage der späteren On-Chain-Zuordnung; sie ist noch nicht durch eine eigene 402-Antwort bestätigt. |
facilitator.payai.network | 2026-10-29 |
| Pricing | Provider claim |
0.001 USDC per call
EvidenceAtomic amount 1000 = 0.001 USDC per call on Base. Netzwerk: Base. |
facilitator.payai.network | 2026-10-29 |
| Protocol | Provider claim |
x402 (HTTP 402 payment challenge)
EvidenceIm x402 Bazaar als zahlungspflichtige HTTP-Ressource gelistet (x402Version 2, Typ http). |
facilitator.payai.network | 2026-10-29 |
| Provider | Provider claim |
47-85-47-24.sslip.io
EvidenceDie Ressource wird unter diesem Host im x402 Bazaar geführt; die Angaben stammen vom Anbieter. |
facilitator.payai.network | 2026-10-29 |
We have not called this endpoint yet. Until we do, everything above is what the source published — no more.