Operators / ransomware-tracker.com
Named for the host that took 100% of this group’s x402 payments in the window; the registry lists 14 hosts under the same wallet.
unclaimed group14 hosts · 1 walletas of 21 October 2026
Hosts paid into one wallet are usually one operator, sometimes a platform collecting for several. Nobody has put a name on this group yet.
14hosts paid into this wallet
4x402 payments, last 24 h
$2.07USDC, x402-settled
1hosts that took an x402 payment
86calls in 30 days, as the registry reports
Who actually paid the group
x402 payments on Base · 20 October 2026
Across the group, 4 x402 payments in the last 24 h; payer wallets summed per host: 3.
In the full record: the wallets that paid this group, each with its payments. How to get it: the $0.001 check over x402 and Atlas Pro at $49 a month.
The hosts
| host | x402 payments | registry calls, 30 d | payers | sells |
|---|
| api.ransomware-tracker.com | 4 | 19 | spread | Dragons Eye Lookup: Ransomware leak-site claim lookup by company name or domain. Returns r |
| api.orioncmd.com | 0 | 15 | — | OrionCMD Checks: Domain threat check: IOC feed match (name + resolved IPs) and ransomware |
| api.paidpilot.io | 0 | 14 | — | PaidPilot Invoice API: Timesheet to invoice JSON. Time entries (hours x rate, optional per |
| api.isitdownapi.com | 0 | 7 | — | 60SecMonitor Status API: Current outage status for a vendor (60SecMonitor). Current status |
| api.inboxguardstest.com | 0 | 5 | — | InboxGuards Email Test: Email address check: syntax, MX, disposable and role account (no S |
| api.mailsecuritytools.com | 0 | 4 | — | Mail Security Tools API: Graded email security score (0-100, A-F) for a domain. Scores SPF |
| 60secmonitor-status-api.dario-9fa.workers.dev | 0 | 3 | — | 60SecMonitor Status API: Current outage status for a vendor (60SecMonitor). Current status |
| api.pulsewatch.us | 0 | 3 | — | PulseWatch Status API: Current outage status for a vendor (PulseWatch). Current status, ac |
| dragonseye-lookup.dario-9fa.workers.dev | 0 | 3 | — | Dragons Eye Lookup: Ransomware leak-site claim lookup by company name or domain. Returns r |
| orioncmd-checks-mcp.dario-9fa.workers.dev | 0 | 3 | — | OrionCMD Checks: Certificate status from CT logs + live HTTPS probe. Issuer, validity, day |
| paidpilot-invoice-api.dario-9fa.workers.dev | 0 | 3 | — | PaidPilot Invoice API: Render one invoice PDF from JSON. Line items, tax, discount and tot |
| pulsewatch-status-api.dario-9fa.workers.dev | 0 | 3 | — | PulseWatch Status API: Current outage status for a vendor (PulseWatch). Current status, ac |
| aeoinspector.com | 0 | 2 | — | AEO Inspector: One-domain report: site security grade + AI visibility (AEO), every fix wit |
| api.freesmallbiztools.com | 0 | 2 | — | Free Small Biz Tools API: Late-fee reminder email for an overdue invoice. Calculates the l |
How to read this
- Hosts are grouped because the registry lists the same payTo wallet for them. That is what the wallet shows, and nothing more: usually one operator, sometimes a platform collecting for several.
- x402 payments are transfers a facilitator settled on a buyer’s signature, on Base, over the window. Money that reached the same wallet by ordinary transfer is shown apart and is not a call.
- Payer wallets are summed per host: a wallet paying two hosts counts twice. A wallet is not a person.