x402 DACH Radar, Issue 1: Who Is Knocking, and Who Actually Pays?
x402 DACH Radar, Issue 1. Primary measurement from nine paid API endpoints we operate ourselves on Base mainnet. Measurement window 23 to 26 July 2026.
Every figure marked “own measurement” comes from our own demand counter, every figure marked “study” from the cited literature. Every factual statement carries a confidence tag, every headline claim carries a falsifier. What we did not measure is labelled as not measured.
Published by OzDreamWalk. Not legal and not tax advice.
Table of Contents
Part A: Report
1. The short version
- Three days, 7,331 foreign requests, 66 distinct identifiers. We run nine paid endpoints on Base mainnet and count every call.
[HIGH, own measurement] - Almost everything knocking is infrastructure. The names come overwhelmingly from the directory, liveness and trust space. Of 66 identifiers, 24 ever asked for a price at all; 42 never got past a wrong method or a rejected body.
[MED, classification by name] - Exactly one payment came from a stranger: 0.01 USDC, proven on chain, identifier
Dexter-Verifier/1.0. Under this project’s metric doctrine that is the first independent external payer. Whether it demonstrates demand for the content is open and dissected in section 5.[HIGH, own measurement and chain] - The number that matters is conversion: 1 of 517 price requests was paid, that is 0.19 percent. On the most requested route alone, 1 of 365, that is 0.27 percent.
[HIGH] - Change the path of your endpoint and you drop out of the directory until you settle there again. Measured on our own portfolio, with a control group, and confirmed by a prediction made before the test.
[HIGH, own measurement, prediction recorded beforehand]
2. How this was measured
Every call to a paid route leaves one row: timestamp, route, outcome, truncated identifier, country code, price, payer address, settlement hash, raw HTTP status. No IP address, no request body. That is a design decision, and it limits what we can say (section 10). Our own runs are excluded by payer address and identifier prefix: 329 of the 7,660 rows are ours.
Two properties shape the figures below. Input validation sits in front of the paywall, so a call with a malformed body never sees a price. And one row in the stock reproduces a counting defect that has since been fixed and stays where it is, because measurement data here is resolved by rule rather than rewritten.
3. Who is knocking
66 distinct identifiers, 7,331 requests. The eight largest:
| Identifier | Requests | Routes | what the name says |
|---|---|---|---|
mako-pulse-prober/0.1 | 1,161 | 3 | prober |
hastalavista.ai-liveness/1.0 | 1,000 | 7 | liveness monitor |
CarbonMonitor/0.1 healthcheck | 876 | 10 | liveness monitor |
forum-labs-trust-prober/1.0 | 806 | 10 | prober |
node | 601 | 10 | bare runtime, not attributable |
axios/1.18.1 | 530 | 11 | bare library, not attributable |
dexter-api/x402-schema-fetcher | 428 | 10 | directory |
x402-observer/1.0 | 356 | 10 | liveness monitor |
Further out sit kkj-x402-trust-index, AgentReeve (in three versions), CoinbaseBazaarDiscovery/1.0, x402-census-probe, x402Scout, 402explorer, x402statsweb, entropy-daemon-trust-oracle, Attest-Scanner, MPP32-Health, Nitrograph-HealthCheck, TrustBench-Prober and GPTBot/1.4. The full list is in appendix B4.
Origin: United States 4,324, Germany 1,611, Mexico 570, Netherlands 274, France 191, Japan 132, Switzerland 85, Cyprus 60, Denmark 45, Finland 20, Singapore 12, India 2, Thailand 1, Poland 1, without country code 4. [HIGH]
Two things stand out. First the call pattern: anyone requesting ten or eleven different routes is walking the catalogue, not pursuing a particular answer. Of the 66 identifiers, only 24 ever asked for a price; 42 never got past a wrong method or a rejected body. Second the growth: our own project notes counted roughly 15 identifiers on 23 July, and three days later there are 66. A new paid endpoint in the German speaking market is picked up within hours to days by an entire field of international directory and verification services, without registering anywhere. [MED, prior value from project notes, not derived with an identical query]
Germany sits second with 1,611 requests, but that is not a DACH demand signal: the country code comes from the caller’s exit node, not from its operator, and a verification service hosted in Frankfurt counts as German. [MED]
4. What actually saw a price
517 price requests in total: agent-ready 365, llmstxt 35, outreach 24, holidays 20, bfsg 20, invoice 18, the remaining routes 35 between them. The free catalogue was fetched 39 times.
The larger part of the traffic is not demand at all. 6,770 foreign requests never reached a price, and the raw status splits them into two behaviours: 3,936 rejected bodies (400) and 2,824 calls with the wrong method (405), meaning GET against a route that expects POST. That is the fingerprint of liveness probing, not of buying intent. [MED, interpretation] The split is only visible because the counter stores the raw status alongside the interpreted outcome; the interpreted bucket throws both together.
5. The first payment from a stranger
On 24 July 2026 at 21:20:03 UTC a foreign address paid for one of our routes for the first time. Route agent-ready, 0.01 USDC, payer 0x7e57…, identifier Dexter-Verifier/1.0, country US, response 200. [HIGH, own measurement]
The proof is block pinned, not inferred. Transaction 0x1978bda977…, block 49069329, status success, balance of the receiving address 0.90 USDC at block N minus 1 and 0.91 USDC at block N, exactly one transfer of 0.01 USDC, gas paid by a third party. Our own verification tool exits with code 0. [HIGH, primary source chain]
What this is. The first payment to this service that does not come from our own address. Under the metric doctrine adopted for this project that is an independent external payer, the first since the counter went live. The other 20 settlements in the window are our own measurement runs and are labelled as such. [HIGH]
What this is not. Evidence that an agent needed the assessment for its content. The identifier belongs to the same family as dexter-api/x402-schema-fetcher, which made 428 requests across ten routes in the same window. The obvious reading is therefore that a directory or verification service paid in order to establish that we really do charge. That reading is not proven. We do not measure third party motives; it rests on the identifier name, the sibling identifier and the call pattern. [MED, circumstantial]
What stays open. Repeat purchases: zero. A repeat rate over a single payer is not a rate. This report puts both readings side by side and does not decide between them.
6. The directory rule
The CDP directory held 14,376 entries on 26 July, swept exhaustively. Six of our nine routes were listed, and for all six the entry timestamp matched the most recent settlement of the same URL to under a second. After the test below it is seven of nine. [HIGH, own measurement]
| Group | Routes | in the directory |
|---|---|---|
| never renamed, settled | 4 | yes |
| renamed and settled afterwards | 2 | yes |
| renamed, settled in the test | 1 | yes, newly created |
| renamed, never settled afterwards | 2 | no |
The last row is the finding, the second is the control group: holidays and invoice were renamed exactly like the missing ones, but were paid once more under the new path. The difference is therefore not the rename, it is the missing settlement after it.
The entry hangs on the settled resource URL. A path change throws you out until the new path has settled once itself. A polite 410 redirect does not carry the entry across.
Cross checked on 26 July as a prediction rather than a reconstruction, and both predictions came true. The prior state was recorded, the prediction written down, then 0.05 USDC paid to a previously unlisted route. The directory crawler appeared in our own counter 374 milliseconds later, and the entry was created new, carrying a timestamp 459 milliseconds after settlement. The two control routes left unpaid are still absent.
One detail makes the rule usable: one minute after the payment the entry was not yet visible, after 32 minutes it was. But it carries the timestamp of the settlement, not of the indexing. Anyone checking shortly after a payment and finding nothing has looked too early rather than refuted the rule. That exact mistake led us to conclude prematurely on 23 July that entry creation was unproven.
Side finding, deliberately marked weak: the same sweep counted 24,910 entries on 23 July. The two measurements are [HIGH, own measurement], the statement “the directory is shrinking” is [LOW, observed once, cause open, third measurement pending]. We name no cause.
7. Market frame
One figure from the literature is enough for context here: the median lifetime revenue per resource is 3.96 US dollars [HIGH, study]. Measured against that, our single foreign cent is not an embarrassing number but an early one. The remaining study figures, the wash trading ranges and the security finding are in appendix B7, because they are somebody else’s measurement and not ours. The tracker values we used previously (roughly 28,000 US dollars per day, roughly 50 percent wash trading) are no longer carried as current. [CONFLICT, superseded]
8. What operating this actually costs, and what goes wrong
This section is the part nobody can write without running the thing. All measured, none of it copied from documentation.
Settlement costs us nothing. Verified twice independently, block pinned: the requested amount arrives at the seller in full, no facilitator fee is detectable, and the gas is carried by a third party, neither the buyer nor us. The buyer needs no ETH. That is the economically most important property of the mechanism and the reason amounts of one cent make sense at all. [HIGH, own measurement]
A free text field over 500 characters makes the route unpayable. Description and service name together must not exceed 500 characters, otherwise the facilitator rejects the entire payload, with an error message naming neither the field nor the length. One of our routes ran live for a day at 532 characters and served correct price demands that nobody could pay. From the outside that looks like a working route. [HIGH, own measurement]
An empty wallet reports itself as “invalid payload”. When our test buyer fell to 0.02 USDC, our verification suddenly reported two of nine routes as fine and seven as faulty, pointing at the payload. The payload was fine. The boundary sat exactly at the price: what cost 0.01 and 0.02 passed, everything from 0.05 up did not. The facilitator simulates the transfer, and that reverts on insufficient balance. Anyone believing this error message looks for the fault in the code instead of in the wallet. [HIGH, own measurement]
Change the path and you disappear from the directory (section 6). That is the most expensive operational mistake on this list because it is silent: the route keeps working, keeps charging, keeps answering correctly, and is no longer found.
Your own counter will otherwise measure itself. Our first version fetched the free catalogue on every run, and the catalogue is counted: 96 self generated rows per day inside the very metric meant to show foreign demand. The same trap a second time: our own tools carried no identifier of their own and therefore ran as foreign price requests. Anyone measuring demand must first be able to subtract themselves. [HIGH, own measurement]
An interpreted status value loses half the information. Our counter kept 405 (wrong method) and 400 (malformed body) in the same bucket. Only the raw status stored alongside separates liveness knocking from genuine failed attempts, and that is 2,824 against 3,936 requests. Store only the interpreted value and you cannot ask that question later.
9. What this means for a data provider
Not a recommendation, just what follows from the measurements above. Four things for anyone considering pricing their own content for machines.
Discoverability is coupled to settlement, not to registration. You sign up nowhere. The entry appears once real money has moved through the address for the first time, and it hangs on the exact URL. That is good (no application, no waiting) and dangerous (every path change throws you out).
Over ninety percent of the traffic is not demand. Of 7,331 foreign requests, 517 reached a price at all, and one was paid. Anyone seeing “thousands of hits” after two weeks is most likely measuring directory and availability checkers. The only figure that says anything is the share converting from price demand to payment.
Your first revenue will probably come from a verification service. Our single foreign payment was by all appearances an index establishing whether we really charge. That is not a market signal, but it is a functional proof: the chain works all the way to money arriving.
Anchor your revenue expectation at the median. 3.96 US dollars lifetime revenue per resource and roughly half the hosts dead is the realistic frame for 2026. Build a route so that it pays for itself even if no machine ever pays for it. That is exactly our own position: the nine routes are a measurement surface first and a revenue source second.
10. What this does not prove
| Claim | What would overturn it |
|---|---|
| The visitors are directory and verification services, not agents interested in content | An identifier with no index, trust or probe connection requests a single route repeatedly with a valid body and pays more than once |
| First independent external payer | Evidence that the address is attributable to us, or an older foreign payment to our receiving address |
| The payment proves no content demand | The same payer pays repeatedly, with varying subject matter inputs, or the operator discloses what it pays for |
| The entry hangs on the settled URL | One of the two remaining unlisted routes appears without its own settlement, or a future settled one fails to appear within 24 hours |
| Most of the traffic never sees a price | A code path test shows that a 400 can also arise behind the paywall |
| The directory is shrinking | A third sweep with the same method lands back around 25,000, or the operator documents a change |
Two limits remain. 66 identifiers are not 66 actors, and we cannot resolve that, because we deliberately collect nothing that would allow deduplication. And the demand structure is shaped in part by our own architecture: because input validation sits in front of the paywall, malformed calls never appear as price requests.
11. Next issue
From issue 2 the window is a calendar month. The absolute figures of this pilot are not comparable to a month, only rates are compared. Three measurements are carried forward verbatim until answered: the third directory data point, whether the foreign payer returns, and a price comparison across the full directory rather than a sample.
Method: the basis is our own demand counter across nine paid endpoints we operate ourselves, window and upper bound in the header of this document. The queries behind it are frozen so that the next issues stay comparable. Four conflicts are named here and not resolved. First, our own decision to validate in front of the paywall shapes the demand picture; whether it inflates or dampens it is undetermined. Second, the single foreign payment is simultaneously the first independent external payer under the doctrine used here and plausibly an index service checking whether we charge; both readings stand. Third, three directory figures from three methods (24,910, 14,376 and the study’s 25,163) have not been reconciled, and their proximity is not mutual confirmation. Fourth, identifiers are self declared; the figure 66 is a lower bound on variety and not a count of actors.
Part B: Data appendix
Carries every figure from Part A.
B1 Reconciliation identities (pin id <= 7660)
| # | Identity | Result |
|---|---|---|
| 1 | total = own + foreign | 7,660 = 329 + 7,331 |
| 2 | foreign = sum of outcomes | 6,770 + 517 + 39 + 5 = 7,331 |
| 3 | sum of countries = foreign rows | 7,327 + 4 without country code = 7,331 |
| 4 | sum of 402 per route = total 402 | 517 |
| 5 | settlements carrying a hash | 20 own + 1 foreign = 21 |
B2 Foreign outcomes, interpreted against raw
| Outcome (interpreted) | Count | Raw status | Count |
|---|---|---|---|
400 | 6,770 | 400 | 3,936 |
| 405 | 2,824 | ||
| without status | 10 | ||
402 | 517 | 402 | 514 (3 legacy rows without status) |
free | 39 | 200 | 35 |
paid | 5 | 200 | 1 (only this one carries a hash) |
B3 Price requests per route (foreign)
agent-ready 365, llmstxt 35, outreach 24, holidays 20, bfsg 20, invoice 18, rechnung 12, feiertage 6, fristen 5, lesbarkeit 4, impressum 4, deadlines 2, readability 1, imprint 1. The German names are the paths valid until 24 July; the mapping of old to new paths is carried between issues.
B4 Foreign identifiers, complete (66)
Identifier, requests, routes requested, of which price requests. Truncated to 58 characters. An identifier is self declared and forgeable; this list is a lower bound on variety.
| Identifier | Requests | Routes | 402 |
|---|---|---|---|
mako-pulse-prober/0.1 | 1161 | 3 | 0 |
hastalavista.ai-liveness/1.0 (+https://hastalavista.ai; x4 | 1000 | 7 | 40 |
CarbonMonitor/0.1 healthcheck (+https://carbon-cashmere.de | 876 | 10 | 0 |
forum-labs-trust-prober/1.0 (x402 endpoint QoS monitor; +h | 806 | 10 | 72 |
node | 601 | 10 | 27 |
axios/1.18.1 | 530 | 11 | 24 |
dexter-api/x402-schema-fetcher | 428 | 10 | 2 |
x402-observer/1.0 (uptime+trust monitor; +https://x402.fuc | 356 | 10 | 59 |
kkj-x402-trust-index/0.1 (liveness+consistency verificatio | 282 | 10 | 0 |
x402-reliability-probe/1.0 | 131 | 2 | 42 |
MPP32-Health/1.0 (+https://mpp32.org) | 98 | 6 | 8 |
CoinbaseBazaarDiscovery/1.0 (+https://docs.cdp.coinbase.co | 95 | 12 | 95 |
AgentReeve/0.1 (independent x402 index; polite daily probe | 95 | 11 | 12 |
x402-census-probe/2.1 (independent index research) | 85 | 6 | 85 |
x402Scout/1.0 (https://app-production-cd86.up.railway.app; | 83 | 3 | 0 |
entropy-daemon-trust-oracle/2.0 | 74 | 6 | 0 |
Deno/2.7.4 | 60 | 10 | 0 |
AnalogHubris-TrustIndex/0.2 (health survey; no payment att | 60 | 6 | 5 |
AgentReeve/5.1 (+https://agentreeve.com) | 60 | 5 | 0 |
curl/8.14.1 | 50 | 15 | 22 |
litebeam-probe/1.0 | 45 | 11 | 7 |
Dexter-Verifier/1.0 | 41 | 10 | 5 |
AgentReeve/1.0 (independent x402 index; polite daily probe | 33 | 6 | 1 |
402explorer/0.1 (+https://discover.paygent.net/about) | 22 | 10 | 0 |
x402statsweb/1.0 (+https://x402stats.decredcommunity.org; | 20 | 10 | 3 |
TrustBench-Prober/1.0 | 18 | 3 | 0 |
Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.3 | 15 | 1 | 0 |
Deno/2.1.4 | 15 | 3 | 0 |
anpay-enrich/0.1 (+https://anpay.dev/bot) | 12 | 6 | 0 |
Mozilla/5.0 (compatible; x402-directory-verifier/0.1) | 12 | 3 | 0 |
MainstreetHealthProbe/1.0 (+https://avisradar-production.u | 12 | 2 | 0 |
Attest-Scanner/1.0 (+https://attestagent.org) | 12 | 3 | 0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. | 11 | 8 | 0 |
x402-liveness-directory/1.0 (+https://x402-liveness.malach | 10 | 6 | 0 |
LION-Probe/1.1 (+x402 liveness) | 10 | 10 | 0 |
ioi-indexer/1.0 | 9 | 9 | 0 |
Nitrograph-HealthCheck/1.0 (+https://api.nitrograph.com/bo | 9 | 3 | 0 |
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compati | 9 | 9 | 0 |
Mozilla/5.0 (compatible; railscope-verifier/0.2; +https:// | 9 | 2 | 0 |
Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) A | 7 | 7 | 0 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, | 6 | 6 | 1 |
Market402Probe/0.1 (+https://market402.com; verification p | 6 | 6 | 1 |
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compati | 5 | 5 | 0 |
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compati | 5 | 5 | 0 |
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) | 5 | 5 | 0 |
Agent402Bot/0.1 (+https://agent402.app/bot) | 5 | 3 | 0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. | 4 | 2 | 0 |
ScoutScore-HealthCheck/1.0 | 3 | 1 | 0 |
ScoutScore-FidelityCheck/1.0 | 3 | 1 | 1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. | 3 | 1 | 0 |
AgentIndexBot/0.1 (+https://agents.traderszone.net; polite | 3 | 1 | 0 |
x402register-vantage/1.0 (+https://x402register.com; resea | 2 | 1 | 2 |
x402-measure preflight (read-only; no payment is ever sent | 2 | 1 | 0 |
x402-interop-preflight (research; no payment sent) | 2 | 1 | 0 |
x402-census/1.0 | 2 | 1 | 1 |
ora-capabilities-probe/1.0 | 2 | 2 | 0 |
assay-probe/0.1.0 | 2 | 1 | 0 |
x402-conformance-probe/1.0 | 1 | 1 | 0 |
x402-census/0.2 (+endpoint health survey; one unpaid 402 h | 1 | 1 | 1 |
tenet-boi-labels/0.1 | 1 | 1 | 1 |
n8n | 1 | 1 | 0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/ | 1 | 1 | 0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. | 1 | 1 | 0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. | 1 | 1 | 0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 15.7; rv:149.0) Gec | 1 | 1 | 0 |
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) | 1 | 1 | 0 |
B5 Countries (foreign)
US 4,324, DE 1,611, MX 570, NL 274, FR 191, JP 132, CH 85, CY 60, DK 45, FI 20, SG 12, IN 2, TH 1, PL 1, without code 4.
B6 Directory, as of 26 July 2026
| Route | Entry updated | Last settlement of the same URL |
|---|---|---|
agent-ready/assess | 2026-07-26T14:52:32.467Z | 2026-07-26T14:52:32.060Z |
bfsg/check | 2026-07-23T16:26:14.058Z | 2026-07-23T16:26:13.616Z |
holidays | 2026-07-24T06:35:07.095Z | 2026-07-24T06:35:06.660Z |
invoice/check | 2026-07-24T07:06:54.707Z | 2026-07-24T07:06:54.423Z |
llmstxt/generate | 2026-07-23T21:03:44.364Z | 2026-07-23T21:03:43.943Z |
outreach/policy | 2026-07-23T16:27:18.189Z | 2026-07-23T16:27:17.750Z |
deadlines | 2026-07-26T16:05:55.983Z | 2026-07-26T16:05:55.524Z (test, entry newly created) |
imprint, readability | not listed | none under this path |
Total 14,376 before the test, 14,387 after.
B7 Market frame from the literature, as ranges
Somebody else’s measurement, not ours. [HIGH, study]
- Over 280 days on Base: 21.20 percent of settlements fictitious, 63.78 percent cluster internal, 15.02 percent external and not attributable.
- Demonstrably reaching nameable services: 187,861 US dollars. Upper bound for “real”: 20.26 million US dollars, 45.92 percent. Upper bound, not a point estimate.
- 25,163 resources spread across 811 recipients, of which 249 took at least 10 US dollars. 52.09 percent of hosts were still reachable. Median lifetime revenue 3.96 US dollars.
- Security: 49 rule violations produced 31 previously unknown vulnerabilities among facilitators carrying 99 percent of transactions between them. No vendor is named here; we cite the result, not a ranking we did not produce.
The study’s 25,163 resources sit close to our own 24,910 from 23 July. That is not mutual confirmation: different collection time, and whether “resource” means the same thing in both is unverified. [MED, comparability of the population unverified]
B8 All nine metrics
| Metric | Value |
|---|---|
| independent buyers | 1 |
| conversion from 402 to paid | 1 of 517, 0.19 % |
| repeat rate | not determinable (n=1 buyer, 0 repeats) |
| revenue per resource | 0.01 USDC on agent-ready, zero elsewhere |
| buyer concentration | 100 % on one buyer |
| contribution margin per request | not collected (marginal cost zero, fixed cost not allocated) |
| error and refund rate | no refunds; no 5xx occurred in the window |
| availability | not collected in this window |
| time to first 402 | 13 minutes after go live (23 July, 14:32 to 14:46) |
