payment-ready until 2026-09-28
imported from the x402 Bazaar, not submitted by the operator · own this service? claim it · or ask to be removed
Pay-per-call IP intelligence API. Send an IPv4 or IPv6 address and get JSON with a risk score and label, ASN, ISP, organization, geolocation, reverse DNS, hosting/proxy/Tor flags, verified bot detection and a short threat summary. Priced at $0.001 per call in USDC on Base.
Pay from $0.001 per request in USDC on Base, settled onchain via the x402 protocol, no signup, no API key needed.
measured since 2026-06-21 (start of our harvest window) · $4.50 all-time · settled via coinbase
VERDICT
ranking generation 3solid 84/100 #132 of 299 in Data by measured score
What the score read on this service: status online, 99.9% uptime 30d, 2099ms response p95, x402 compliance 14 of 14, $0.001 price against the category, on-chain traction measured. Each of those is measured, and each is published in full below.
The score comes from our own monitoring, never from reviews, operator claims, or a language model: reliability, x402 compliance, price against the category, a deterministic risk flag, and a small on-chain traction term, weighted by ranking generation 3. It is not placement anyone can buy: the paid verify tier is reported beside it and is not one of its inputs. Every component below stays published and read-only.
It is a score inside Data, and only there: price and speed are scored against the whole category field, every listing in it that carries no danger flag, the scored service included, which here means 299 listings, this one among them. That set is wider than the 299 the position above is counted against, because a listing we have measured too little of to rank still sits in the field the price and the speed are normalized over. The same service in a different field would read differently. The same engine answers GET /api/v1/best, and asked for a different pool (the whole directory, or another filter) it returns a different number for this service under this same ranking generation. Neither is more correct: they answer different questions, and the methodology states which is which.
Bands on the 0 to 100 measured score: strong at 93 and above, solid from 75, mixed from 55, weak below 55. Price and speed are scored against the whole category field, every listing in it that carries no danger flag, the scored service included, so the score places a service in its own field.
ALTERNATIVES IN DATA
Other Data services in this directory, ordered by the same measured score. The figures are ours: 30-day uptime from our own probes, 30-day settlement volume read on-chain (a conservative undercount, and null where we cannot measure it, never a zero).
| SERVICE | BAND | SCORE | UPTIME 30D | VOL 30D |
|---|---|---|---|---|
| StableEnrich | strong | 96 | 100% | $1.9k |
| glim.sh | strong | 95 | 100% | $48.83 |
| SniperX•x402 | strong | 95 | 100% | $367.75 |
| cn402 | strong | 94 | 100% | $36.89 |
| API Acre | solid | 92 | 99.5% | $31.95 |
ASSESSMENT
updated 2h agoThe parts the verdict above is computed from, each with its proof. Click any chip. Measured values stay read-only; unknown is honest, and an unknown is never counted as a zero.
reliability 99.9%
- uptime 24h
- 100%
- uptime 7d
- 100%
- uptime 30d
- 99.9%
- uptime 90d
- 100%
- response p95
- 2099ms
- avg response
- 1213ms
- total checks
- 2,777
Measured on the unpaid 402 handshake, not the paid call. A service can 402 correctly and still fail after payment.
compliance A (14/14)
14 of 14 x402 conformance checks pass. Full checklist below.
price $0.001 (p10 in Data)
- price (min)
- $0.001
- category percentile (min)
- p10 in Data
- endpoints / prices
- 1 / 1
- model
- flat
- stability
- 100%
risk clean
No deterministic risk flag. Risk fires only on an exact blocklist match, or a reserved-brand name with a mismatched verified payTo. Never from low uptime, a high price, or a model guess.
- domain age
- -
- registrar
- -
- hosting
- custom
- domain created
- ---
Identity facts, not a risk score.
traction $3.44 30d · 29 buyers
- volume 30d
- $3.44
- buyers 30d
- 29
- settlements 30d
- 411
- measured since
- 2026-06-21 (start of our harvest window)
- last settlement
- 2026-09-20
- top buyer share
- 66% of 30d volume
- trend 7d vs 30d
- 1.48x the 30d daily rate
- networks
- eip155:8453
- volume all-time
- $4.50
- settlements all-time
- 788
- median settlement 30d
- $0.025
- max settlement 30d
- $0.09
- settled via
- coinbase ($10.32, 411 tx)
Attributed pro-quota: this payout address is shared, so volume is the operator-level figure divided by the services sharing it, while buyer and transaction counts stay whole. A declared convention, not an individually observed measure, and still a conservative undercount.
Currently sharing this payout address with IPIntel.ai Satellite & GeoRisk API, IPIntel.ai x402 Tools.
Top buyer share is a concentration signal, not part of the ranking score.
WHAT IT DOES
ai-derivedProvides IP address lookup and risk assessment services
- category
- ip-intelligence
- in
- body
- auth
- api key
AI-generated summary. The measured data is never altered by it.
ENDPOINTS
| METHOD | PATH | DESCRIPTION | PRICE | NETWORK | ASSET | 402 CHANNEL |
|---|---|---|---|---|---|---|
| POST | /x402v2 | $0.001 | Base | USDC | header |
REQUEST / RESPONSE EXAMPLE
An unpaid request to POST /x402v2 returns HTTP 402 with the payment terms. Settle onchain via your facilitator, then retry with the X-Payment header.
curl -i -X POST 'https://api.ipintel.ai/x402v2'
// 402 response (captured by monitor) · 1 payload · click to expand
[
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x0550779CFBc832657A8BB46BAC9f359A5ad038B8",
"amount": "1000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://api.ipintel.ai/x402v2",
"tags": [
"ip-lookup",
"ip-intelligence",
"ip-risk-score",
"geolocation",
"proxy-vpn-tor"
],
"iconUrl": "https://api.ipintel.ai/favicon.ico",
"mimeType": "application/json",
"description": "Pay-per-call IP lookup and risk intelligence API. Send an IPv4 or IPv6 address and receive JSON with risk score, risk label, ASN, ISP, organization, geolocation, reverse DNS, hosting/proxy/VPN/Tor signals, verified bot detection, scanner/honeypot indicators, and AI-powered subnet behavior analysis via x402 v2 on Base.",
"serviceName": "IPIntel.ai IP Lookup & Risk API"
},
"extensions": {
"bazaar": {
"info": {
"input": {
"body": {
"ip": "8.8.8.8"
},
"type": "http",
"method": "POST",
"bodyType": "json"
},
"output": {
"type": "json",
"example": {
"ip": "8.8.8.8",
"asn": "AS15169",
"isp": "Google LLC",
"org": "Google Public DNS",
"city": "Ashburn",
"is_tor": false,
"country": "US",
"is_proxy": false,
"confidence": 100,
"is_hosting": true,
"risk_label": "Safe",
"risk_score": 15,
"reverse_dns": "dns.google",
"threat_summary": "This IP is considered safe and does not pose a threat. Only minimal and non-threatening activity has been observed.",
"is_verified_bot": false
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method",
"bodyType",
"body"
],
"properties": {
"body": {
"type": "object",
"required": [
"ip"
],
"properties": {
"ip": {
"type": "string",
"description": "IPv4 or IPv6 address to analyze, passed in the JSON request body"
}
},
"additionalProperties": false
},
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object",
"properties": {
"ip": {
"type": "string",
"description": "Queried IPv4 or IPv6 address"
},
"asn": {
"type": "string",
"description": "Autonomous system number"
},
"isp": {
"type": "string",
"description": "Internet service provider"
},
"org": {
"type": "string",
"description": "Organization name"
},
"city": {
"type": "string",
"description": "City, when available"
},
"is_tor": {
"type": "boolean",
"description": "Whether the IP appears to be a Tor exit node"
},
"country": {
"type": "string",
"description": "Country code or country name"
},
"is_proxy": {
"type": "boolean",
"description": "Whether the IP appears to be a proxy"
},
"confidence": {
"type": "number",
"description": "Confidence percentage from 0 to 100"
},
"is_hosting": {
"type": "boolean",
"description": "Whether the IP appears to belong to hosting/cloud infrastructure"
},
"risk_label": {
"type": "string",
"description": "Human-readable risk label"
},
"risk_score": {
"type": "number",
"description": "Risk score from 0 to 100"
},
"reverse_dns": {
"type": "string",
"description": "Reverse DNS hostname, when available"
},
"threat_summary": {
"type": "string",
"description": "Short natural-language threat assessment"
},
"is_verified_bot": {
"type": "boolean",
"description": "Whether the IP appears to be a verified known bot"
}
},
"additionalProperties": true
}
}
}
}
}
}
},
"x402Version": 2
}
] OVER TIME
All charts use the 30d selector; each series spans only the dates it has data for. Every series is also served as JSON at /api/v1/services/ipintel-ai-ip-lookup-risk-api/price, /scores, /volume and /buyers. On-chain volume and distinct buyers are measured over the service's settlement address and are a conservative undercount (only settlements that reach a measured facilitator are counted). The on-chain series roll up hourly, so the latest day can be up to about an hour behind; distinct buyers are counted per payout address, so a service that settles to more than one address is an upper bound.
checklist grew 11->14 on 2026-07-28; a step here is a metric change, not a regression
Measured site and economics pillars from the assessment history, so the latest value shown elsewhere on this page reads as a point on a trend rather than a permanent state.
Shared payout address (2 other services). These bars are the full shared address (operator-level), so do not sum them across the services that share it. Where a per-service figure is attributed, the assessment block and the ranking, it is the address total divided pro-quota by the 3 services sharing it: a declared convention, not an individually observed measure.
Shared payout address (2 other services). These bars are the full shared address (operator-level), so do not sum them across the services that share it. Per-service buyer and transaction counts are shown whole (integers), not divided; only volume is attributed pro-quota. A declared convention, not an individually observed measure.
COMPLIANCE
14/14 checks pass · grade Alast 402 captured 2026-07-20 · last up 2026-09-21
- 402 payload captured
- accepts[] array present
- payTo address recoverable
- payTo at accepts[0].payTo (conformant shape)
- payTo is a valid on-chain address
- atomic price declared
- atomic price in a sane range
- asset (token) address declared
- network resolves to CAIP-2
- payment scheme declared
- served over HTTPS
- declares the current x402 version (2)
- EIP-712 domain parameters present on every EVM entry
- x402 v2 envelope delivered in the payment-required header
SITE PILLARS
- homepage reachable
- openapi doc
- pricing page
- llms.txt
- robots.txt
- terms page
recent checks (18) live · click to expand
EMBED THIS BADGE
<a href="https://x402-list.com/services/ipintel-ai-ip-lookup-risk-api?utm_source=badge&utm_medium=referral&utm_campaign=embed"> <img src="https://x402-list.com/badge/ipintel-ai-ip-lookup-risk-api.svg" alt="IPIntel.ai IP Lookup & Risk API listed on x402-list" height="28"> </a>
[](https://x402-list.com/services/ipintel-ai-ip-lookup-risk-api?utm_source=badge&utm_medium=referral&utm_campaign=embed)
<a href="https://x402-list.com/services/ipintel-ai-ip-lookup-risk-api?utm_source=badge&utm_medium=referral&utm_campaign=embed"> <img src="https://x402-list.com/badge/ipintel-ai-ip-lookup-risk-api.svg?data=uptime" alt="IPIntel.ai IP Lookup & Risk API uptime on x402-list" height="28"> </a>