Threat IP lookup

War-Tracker maintains a ledger of IP addresses associated with automated abuse against our public and paid surfaces. Buyers query a single IP at a time via a paid JSON endpoint — we do not sell IP lists, bulk dumps, or historical exports.

Class labels in lookup responses are opaque product vocabulary. They describe the kind of automated actor we have observed from that address, not how the label was assigned. For scale context and why we monetize per-lookup instead of publishing lists, see /threat-ips/history.

Endpoint

GET /api/v1/threat-ips/lookup?ip=<IPv4 or IPv6>

Returns HTTP 402 Payment Required for AI training crawlers and other gated clients until an x402 payment is settled, then HTTP 200 with a sanitized JSON body. Invalid or missing ip still returns 200 after payment (see billing below).

Billing (upto scheme, EVM only)

This route uses x402 upto billing — not exact:

• The 402 advertises a maximum authorization of $0.02 USDC (no pre-payment amount oracle).
• $0.02 settles when the IP is on our ledger (matched: true).
• $0.002 settles when the IP is valid but not on the ledger (matched: false), or when the input is invalid (invalid: true, error: "invalid_ip").

Every successful 200 includes coarse network flags (mobile, proxy, hosting) and a licensing field. Demoted addresses return matched: false like any other miss.

Example hit response

{
  "matched": true,
  "ip": "185.142.40.229",
  "classes": ["farm_walker", "noj_farm"],
  "confidence": "high",
  "country": "LB",
  "mobile": false,
  "proxy": false,
  "hosting": false,
  "first_seen": "2026-05-01T12:00:00Z",
  "last_seen": "2026-09-01T08:30:00Z",
  "hit_count": 48,
  "licensing": "…"
}

Class labels (glossary)

Additional labels may appear over time; meanings stay buyer-facing summaries only.

Licensing

By purchasing this data you agree not to share it with third parties without express written consent from war-tracker.com. If this data is shared with third parties, you accept a penalty of $1 USDC per infraction.

Per-lookup purchase covers your own use of the returned dossier. Redistributing lookup results or building a competing IP-reputation feed without written consent is not covered — contact sales@war-tracker.com.

Related docs

• Launch post — rollout notes and integration checklist
• Threat IP history — scale narrative and monetization model
• /pricing and /x402 — full x402 policy
• /api/v1/openapi.json — OpenAPI (lookup schema when published)