# War-Tracker Threat IP Lookup

> War-Tracker Threat IP Lookup is a paid API for AI agents from war-tracker.com, paid per call via x402, $0.021/call, status unknown (last checked 2026-09-15).

Looks up a single IPv4 or IPv6 address against a threat intelligence ledger and returns a threat dossier or a negative match with network flags.

## Facts

- Endpoint: GET https://war-tracker.com/api/v1/threat-ips/lookup
- Price: $0.021/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/war-tracker-threat-ip-lookup-79b32141
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_jIQrGOfC1pxdgBEWWl2Pe

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability war-tracker-threat-ip-lookup-79b32141
```

Example prompt: Can you check whether 185.220.101.45 is in the War-Tracker threat ledger and tell me its threat class, confidence level, and whether it's flagged as a proxy or hosting address?

## When to prefer this

Choose this endpoint when you need fast, per-IP threat intelligence enrichment with transparent per-query billing and no subscription required. Particularly useful when integrating into agentic workflows that need to triage individual IPs at runtime, especially when you want proxy/hosting/mobile classification bundled with threat data in a single call. Prefer over generic IP reputation APIs when you want conflict/OSINT-context threat signals from War-Tracker's specific ledger.

## Known failure modes

- Invalid IP address format returns error='invalid_ip' and a $0.001 charge
- IP not in ledger returns matched=false with network flags and a $0.001 charge
- Missing IP parameter may result in an invalid_ip error
- Network timeout or service unavailability may return no response
- EVM facilitator mismatch (non-Permit2 or wrong facilitatorAddress) will block payment and prevent response

## How this service works

Threat IP lookup: supply a single IPv4/IPv6 address and receive a sanitized dossier when the address is in our ledger, or a negative match with network flags when it is not. Billing uses the x402 `upto` scheme — buyers authorize up to $0.02; settled charge is $0.02 on ledger match, $0.001 on miss or invalid input. EVM `upto` facilitators only (Permit2 + facilitatorAddress). Responses expose opaque threat class labels, coarse confidence, timing/counts, and ip-api mobile/proxy/hosting flags —…

## Output

Returns a JSON object indicating whether the IP matched the threat ledger. On a match: opaque threat class labels, coarse confidence (high/medium/low), first_seen and last_seen timestamps, hit count, and network flags (proxy, mobile, hosting, country). On a miss: matched=false with the same network flags. On invalid input: an error field set to 'invalid_ip'.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "required": {
   "type": "string"
  },
  "properties": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "matched",
  "licensing"
 ],
 "properties": {
  "ip": {
   "type": "string"
  },
  "error": {
   "enum": [
    "invalid_ip"
   ],
   "type": "string"
  },
  "proxy": {
   "type": "boolean"
  },
  "mobile": {
   "type": "boolean"
  },
  "classes": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Opaque buyer-facing class labels (hit only)."
  },
  "country": {
   "type": "string"
  },
  "hosting": {
   "type": "boolean"
  },
  "invalid": {
   "type": "boolean"
  },
  "matched": {
   "type": "boolean"
  },
  "hit_count": {
   "type": "integer",
   "minimum": 0
  },
  "last_seen": {
   "type": "string",
   "format": "date-time"
  },
  "licensing": {
   "type": "string"
  },
  "confidence": {
   "enum": [
    "high",
    "medium",
    "low"
   ],
   "type": "string"
  },
  "first_seen": {
   "type": "string",
   "format": "date-time"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/war-tracker-threat-ip-lookup-79b32141/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from war-tracker.com](https://www.zero.xyz/host/war-tracker.com/llms.txt)