# 2s IOC Reputation Check

> 2s IOC Reputation Check is a paid API for AI agents from 2s.io, paid per call via x402, $0.00216/call, status unknown (last checked 2026-10-10).

Checks an IP address, domain, URL, or file hash against multiple threat intelligence feeds (abuse.ch, Feodo Tracker, Tor, Spamhaus) to determine if it is a known malicious indicator of compromise.

## Facts

- Endpoint: GET https://2s.io/api/security/ioc-reputation?utm_source=zero.xyz
- Price: $0.00216/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/2s-ioc-reputation-check-88611062
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_IINak0NHy1ILEDE8omOBU

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 2s-ioc-reputation-check-88611062
```

Example prompt: Can you check if 139.180.203.104 is a known malicious IP — look it up against threat intelligence feeds and tell me if it's flagged as a botnet C2, spam source, or anything else suspicious?

## When to prefer this

Use this endpoint when you need multi-feed threat intelligence reputation checks against well-known public blocklists (abuse.ch, Feodo Tracker, Spamhaus DROP, Tor) for IPs, domains, URLs, or file hashes. Prefer this over single-source lookups when you want a consolidated malicious verdict with per-source breakdown. Ideal for security triage, automated threat detection pipelines, or SOC workflows where no API keys or account signup is desired and pay-per-call USDC billing is acceptable.

## Known failure modes

- Missing or empty 'ioc' query parameter — returns error or 400-level response
- Unrecognized IOC format (e.g. malformed IP or hash) — may return empty results or validation error
- IOC not found in any feed — returns ok:true with malicious:false and zero hits (not an error, just clean)
- Upstream feed unavailability — partial results with reduced sourcesChecked count
- Payment failure via x402 — 402 Payment Required if USDC payment not provided

## How this service works

Threat-intelligence reputation for an indicator of compromise (IOC) — pass ioc as an IP, domain, URL, or file hash (md5/sha1/sha256) and the type is auto-detected. Returns a malicious boolean plus a per-source breakdown: abuse.ch ThreatFox (IOC→malware/threat mapping), URLhaus (malicious URLs on a host/URL), MalwareBazaar (known malware samples by hash), Feodo Tracker (active botnet C2 IPs), Tor exit-node membership, and Spamhaus DROP (hijacked/criminal netblocks). Each source reports listed + a detail. Sourced from live, hourly-rotating threat feeds an LLM cannot know — a ground-truth liveness check for SOC alert triage, log enrichment, and blocklist decisions. Absence of a match is not proof of safety.

## Output

Returns a JSON object with an array of items, each containing: the IOC string, its type (ip/domain/url/hash), a boolean malicious flag, the number of threat sources checked, total hit count, and a per-source results array showing whether it was listed on each feed (e.g. Feodo Tracker, ThreatFox, Tor exit nodes, Spamhaus DROP) with optional detail strings explaining the threat. Also includes source attribution/license metadata.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "ioc": "8.8.8.8"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "required": [
      "ioc"
     ],
     "properties": {
      "ioc": {
       "type": "string",
       "description": "IP, domain, URL, or file hash."
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/2s-ioc-reputation-check-88611062/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)