# AgentAegis Threat Intel Lookup

> AgentAegis Threat Intel Lookup is a paid API for AI agents from agentaegis-mcp-production.up.railway.app, paid per call via x402, $2/call, status unknown (last checked 2026-09-15).

Aggregates reputation and threat verdict for an IP, domain, URL, or file hash across AbuseIPDB, AlienVault OTX, and abuse.ch

## Facts

- Endpoint: POST https://agentaegis-mcp-production.up.railway.app/x402/threat-intel
- Price: $2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentaegis-threat-intel-lookup-ef663c1b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Oc2Sw26EBKqtwX0QZp8g-

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentaegis-threat-intel-lookup-ef663c1b -d '<json body>'
```

Example prompt: Can you check if the IP address 45.155.205.233 is malicious — I want an aggregated threat verdict and score from AbuseIPDB, AlienVault OTX, and abuse.ch?

## When to prefer this

Use this endpoint when you need a quick, multi-source threat verdict for a single IOC (IP, domain, URL, or file hash) without integrating each threat feed individually. Prefer this over single-source checks when you need cross-validated reputation data from AbuseIPDB, AlienVault OTX, and abuse.ch simultaneously in one call.

## Known failure modes

- Unknown or unrecognized IOC format returns an error
- Rate limiting or upstream threat feed unavailability causes partial or failed results
- Invalid indicator type (e.g. plain text instead of IP/domain/URL/hash) rejected
- Payment of $2 USDC not completed causes 402 Payment Required response
- Network timeout from one or more upstream providers may reduce aggregation quality

## How this service works

AgentAegis threat_intel_lookup — reputation + threat verdict for an IOC (IP, domain, URL, or file hash) aggregated across AbuseIPDB, AlienVault OTX, and abuse.ch.

## Output

Returns a JSON object containing the indicator queried, a boolean malicious verdict, and a numeric threat score (0-100) aggregated across AbuseIPDB, AlienVault OTX, and abuse.ch threat intelligence sources.

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentaegis-threat-intel-lookup-ef663c1b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agentaegis-mcp-production.up.railway.app](https://www.zero.xyz/host/agentaegis-mcp-production.up.railway.app/llms.txt)