Threat IP ledger — scale and monetization

War-Tracker operates one of the few large-scale, x402-metered public OSINT APIs on the open web. That attracts sustained automated pressure: scrapers probing paid routes, training crawlers harvesting per-event pages, and farm clients walking share URLs to amortize a single micropayment across thousands of fetches.

Over time we have observed millions of automated requests from a long tail of addresses. Rather than publish raw IP dumps (which would arm abusers and devalue the dataset), we maintain an internal ledger and expose per-IP lookup as a paid product. You supply one IP; we return whether it appears on the ledger, with opaque class labels and coarse timing metadata.

Actor categories (opaque labels)

Lookup responses surface one or more class labels drawn from the glossary at /threat-ips. These are product vocabulary — they group observed automation patterns without explaining internal scoring:

• automation_spoof — Automated client activity
• farm_walker — Automated share-walker activity
• noj_farm — Non-interactive farm client

Monetization

Threat intelligence is sold one lookup at a time via GET /api/v1/threat-ips/lookup. Pricing uses x402 upto settlement: authorize up to $0.02 USDC, charged $0.02 when the IP matches the ledger and $0.002 otherwise (including invalid input). There is no facet browser, no CSV export, and no free bulk API.

Integrators should read the billing table and example JSON at /threat-ips before wiring a buyer client. Smart-account wallets using Permit2 should confirm their x402 library supports upto on EVM — see /x402.

What this page is not

This narrative describes what buyers get and why we charge per lookup. It does not document collection pipelines, internal reason codes, or operational response playbooks.