# What does this x402 endpoint charge? **0.010000 USDC per request** on `eip155:8453` · risk LOW (96/100, v1) ## ENDPOINT | Field | Value | | ----------- | -------------------------------------------------- | | URL | https://dns-whois-lookup.underscoredone.com/lookup | | Canonical | https://dns-whois-lookup.underscoredone.com/lookup | | Endpoint id | 733863122b7b1e2dd6eafb6a9d185b98 | | HTTP status | 402 | | Latency | 155 ms | | Redirects | 0 | | TLS | handshake ok | | Wire form | x402 v2 — PAYMENT-REQUIRED header | | Bytes read | 2 | | Observed at | 2026-08-15T15:16:27Z | | Decoder | accepted — decodePaymentRequired from tx402 | ## PAYMENT These terms were accepted by the strict decoder tx402 uses before it pays. | Field | Value | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Price | 0.010000 USDC | | Amount (atomic) | 10000 | | Scheme | exact | | Network | eip155:8453 · in the tx402 signed manifest | | Asset | USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 · in the manifest | | Pay to | 0xE9740820225B3918b4ddd1292C7cA4Ca0e2C2F08 | | Pay to declared dynamic | no | | Authorization window | 300s | | Resource | https://dns-whois-lookup.underscoredone.com/lookup | | MIME type | application/json | | Description | Send up to 10 domain names and get back every DNS record type (A, AAAA, MX, CNAME, TXT, NS, PTR, SOA, SRV, CAA, NAPTR, DS, TLSA) plus the full WHOIS registration profile (registrar, dates, contacts, status, nameservers) for each one. URLs are accepted and automatically stripped down to the bare domain. Duplicate domains are quietly removed before processing. Results come back as one flat row per domain, ready to drop into a spreadsheet, database, or pipeline. | | Facilitator | not observed | This endpoint offers 2 ways to pay. The report describes the first, which is the order the server stated its own preference in. | # | Requirement | | - | ---------------------------------------------------------------------- | | 1 | 0.010000 USDC · eip155:8453 · exact | | 2 | 10000 (atomic units) · solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp · exact | ## OBSERVED | Field | Value | | ------------------ | -------------------- | | First seen | 2026-08-15T04:00:12Z | | Last seen | 2026-08-15T15:16:27Z | | Scans recorded | 3 | | Availability (30d) | not measured yet | | Latency p50 | not measured yet | | Changed at | What changed | | -------------------- | ----------------------------------------------------------------------------------------------- | | 2026-08-15T05:45:55Z | first_seen: challenge_hash — → f1799aa7477d84c898e3e84250450e4cad2c72ce044798d8fc54db9af868ee9b | ## SECURITY 0 failed, 1 warned, 16 passed. A check that could not run reports `skip` and is never counted as a pass. | Check | Detail | | ---------------------------------- | -------------------------------------------------------------- | | pass wire_form_detected | Served as v2-header. | | pass base64_strict | The strict decoder accepted the header's base64 framing. | | pass json_wellformed | — | | pass x402_version_known | Declared x402Version 2. | | pass accepts_present | The challenge offers 2 ways to pay. | | pass size_within_limit | Read 2 bytes, within the probe's cap. | | pass network_caip2_wellformed | network: eip155:8453 | | pass network_recognized | Recognized means present in the tx402 signed release manifest. | | pass asset_recognized | Recognized means present in the tx402 signed release manifest. | | pass amount_atomic_canonical | — | | pass amount_positive | — | | pass pay_to_wellformed | — | | warn max_timeout_sane | Authorization window 300s exceeds the tx402 maximum of 60s. | | pass resource_origin_match | — | | pass scheme_known | — | | skip facilitator_known | The challenge named no facilitator. | | pass mime_type_wellformed | mimeType: application/json | | pass extra_wellformed | `extra` carries 2 field(s), preserved verbatim. | | skip amount_within_observed_range | No prior observations of this endpoint. | | skip recipient_matches_observed | No prior observations of this endpoint. | ## RISK — LOW (96/100) score_version `v1` · confidence `static_only` · 12 signals scored A band describes how much of what we check we were able to confirm. It is not a judgement about the operator of an endpoint. | Signal | Weight Finding | | ------------------------------- | ------------------------------------------------------------------------------------- | | pass challenge_decodes | 25 The challenge decodes under the strict x402 decoder tx402 uses before paying. | | pass resource_origin_match | 15 The challenge describes the endpoint that served it. | | pass amount_canonical | 12 The amount is a canonical atomic integer. | | pass pay_to_wellformed | 12 The recipient is a well-formed address for the declared network. | | pass network_recognized | 8 The network is in the tx402 signed release manifest. | | pass asset_recognized | 8 The asset is in the tx402 signed release manifest for this network. | | skip facilitator_known | 0 The challenge named no facilitator. | | pass scheme_known | 6 The payment scheme is one tx402 can route. | | pass tls_ok | 5 The endpoint was reached over a valid TLS connection. | | warn timeout_sane | 4 The authorization window is outside the maximum tx402 will sign for. | | pass redirect_scheme_downgrade | 3 No redirect downgraded the connection. | | pass wire_form | 3 The endpoint serves the x402 v2 header form. | | pass amount_magnitude_band | 2 The amount is within the range we see for x402 endpoints. | Methodology: https://tools.tx402.io/methodology?v=v1 ## TEST WITH TX402 Nothing below sends a key anywhere. tx402 commits policy and budget before the signer is reachable, so a refusal is a payment that was never authorized. ```bash npx tx402 call "https://dns-whois-lookup.underscoredone.com/lookup" \ --max-spend "0.010000 USDC" \ --network "eip155:8453" \ --dry-run # --dry-run stops after the policy decision. Nothing is signed and nothing is spent. ``` ```ts import { createTx402Client } from "tx402"; // Your signer stays in your process. tools.tx402.io never sees a key, // never asks for one, and cannot build a payment. import { signers } from "./signers.js"; const tx402 = createTx402Client({ signers, policy: { maxPerRequest: "0.010000 USDC", allowedDomains: ["dns-whois-lookup.underscoredone.com"], allowedNetworks: ["eip155:8453"], }, }); // Policy and budget are committed before the signer is reachable, so a // refusal here is a payment that was never authorized. const response = await tx402.fetch("https://dns-whois-lookup.underscoredone.com/lookup"); ``` ```python from tx402 import Tx402Client, Policy # Your signer stays in your process. tools.tx402.io never sees a key, # never asks for one, and cannot build a payment. tx402 = Tx402Client( evm_signer=evm, policy=Policy( max_per_request="0.010000 USDC", allowed_domains=["dns-whois-lookup.underscoredone.com"], allowed_networks=["eip155:8453"], ), ) # Policy and budget are committed before the signer is reachable, so a # refusal here is a payment that was never authorized. response = tx402.fetch("https://dns-whois-lookup.underscoredone.com/lookup") ``` --- | Representation | URL | | -------------- | --- | | HTML | https://tools.tx402.io/inspect?url=https%3A%2F%2Fdns-whois-lookup.underscoredone.com%2Flookup | | Markdown | https://tools.tx402.io/inspect.md?url=https%3A%2F%2Fdns-whois-lookup.underscoredone.com%2Flookup | | JSON | https://tools.tx402.io/api/v1/inspect?url=https%3A%2F%2Fdns-whois-lookup.underscoredone.com%2Flookup | | History | https://tools.tx402.io/history?url=https%3A%2F%2Fdns-whois-lookup.underscoredone.com%2Flookup | Decoded by `tx402@0.2.0` — the same strict decoder the SDK runs before it pays.