Account-existence oracles, sold by the request
Yellow pages are for businesses, white pages for people. Orange pages return the social media accounts associated with an email address, paid in bitcoin.
The 402 mechanism is the family’s. The lookup is what makes this one different, because it works by exploiting a category of leak rather than by querying anything.
Mapping an email to accounts relies on account-existence oracles. Password reset flows that say “we sent you an email” for a registered address and something different otherwise. Signup forms rejecting an address as taken. Public search endpoints resolving an identifier. Each exists for a good usability reason and each leaks membership.
The mitigation is uniform responses, a reset flow saying the same thing regardless, and a signup not disclosing collision before authentication. Rate limiting helps and has to be keyed on the identifier being probed rather than the source IP, since an attacker enumerating one address from many IPs is the actual threat.
The thing I would say plainly now is that putting a price on this does not make it a service, it makes it an enumeration tool with a payment page. Payment is not a rate limit, it is a cost, and for anyone with a budget not a meaningful one. The line between OSINT and enumeration-for-hire is who is asking and why, and an anonymous paid API knows neither.