# 2s IP Reputation Check

> 2s IP Reputation Check is a paid API for AI agents from 2s.io, paid per call via x402, $0.0036/call, status unknown (last checked 2026-10-10).

Checks the reputation of an IPv4 or IPv6 address against multiple threat intelligence sources, returning a verdict, combined score, and enrichment data.

## Facts

- Endpoint: GET https://2s.io/api/security/ip-reputation?utm_source=zero.xyz
- Price: $0.0036/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/2s-ip-reputation-check-ac77283b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_M6d7YFcM37nuxtjeVjz6K

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 2s-ip-reputation-check-ac77283b
```

Example prompt: Check the reputation of IP address 118.25.6.39 — is it malicious, what sources have flagged it, and what's its combined threat score?

## When to prefer this

Use this endpoint when you need a multi-source IP threat intelligence verdict in a single call without managing API keys for AbuseIPDB, abuse.ch, or blocklist.de individually. Ideal for fraud detection, security automation, or access control workflows where you need a fast, aggregated risk score with enrichment (ASN, ISP, Tor) for an IP address. Prefer over raw blocklist lookups when you want a weighted combined score and per-source opinions.

## Known failure modes

- Missing or invalid 'ip' query parameter returns an error
- Unparseable IP string (not valid IPv4 or IPv6) may return an error or empty result
- Some threat sources may be partially unavailable, reflected in 'partial' array and reduced sourcesAvailable count
- Payment failure via x402 results in 402 response before data is returned

## How this service works

Multi-source IP reputation with one combined authority score (0-100). Polls four independent reputation sources in parallel and blends them: AbuseIPDB (crowd-sourced abuse confidence), abuse.ch threat-lists (Feodo botnet C2 + ThreatFox + Spamhaus DROP + Tor exit nodes), blocklist.de (fail2ban attack-report network), and StopForumSpam. Returns combinedScore, a verdict (clean / low / suspicious / malicious), which sources flagged it, per-source opinions (score + weight + detail), and enrichment (ISP, usage type, country, ASN, Tor). An authoritative threat-list hit (botnet/malware/hijacked netblock) hard-floors the verdict at malicious. Per-source isolation: a down feed degrades that opinion only. The one-call answer for 'should I trust this IP?' instead of trusting a single feed.

## Output

Returns a JSON object with an overall verdict (e.g. 'malicious', 'clean'), a combined integer score (0-100), counts of sources flagged vs available, per-source opinions with scores and details, a list of flagging sources, IP version, and enrichment data including ASN, ISP, country code, domain, usage type, and whether the IP is a Tor exit node.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IPv4 or IPv6 address."
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/2s-ip-reputation-check-ac77283b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)