# Cyber Intel API - IP Threat Summary

> Cyber Intel API - IP Threat Summary is a paid API for AI agents from cyber-intel-api-production-a3c1.up.railway.app, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-15).

Returns an AI-generated cybersecurity risk analysis and abuse score for a given IP address, combining AbuseIPDB data with Claude AI summarization

## Facts

- Endpoint: GET https://cyber-intel-api-production-a3c1.up.railway.app/api/threat-summary/%7Bip%7D
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cyber-intel-api-ip-threat-summary-3ed2e9f3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_K83bA1ShqeRSWi8pSzghb

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cyber-intel-api-ip-threat-summary-3ed2e9f3
```

Example prompt: Can you check whether 118.25.6.39 is a malicious IP — I need its risk score, country, and a quick AI summary of its threat history?

## When to prefer this

Use this endpoint when you need a quick, human-readable AI-generated risk assessment for a single IP address, combining structured abuse score data with natural language explanation. Prefer this over raw AbuseIPDB lookups when you want a synthesized narrative summary rather than raw report counts. Best for security triage, log investigation, or automated threat screening workflows.

## Known failure modes

- Invalid IP address format returns an error response
- Private/reserved IP addresses may return no abuse data
- IP not found in AbuseIPDB returns zero score with limited context
- Railway hosting downtime may cause 502/503 errors
- Rate limits or AbuseIPDB quota exhaustion may block lookups

## How this service works

Cybersecurity threat intelligence powered by AbuseIPDB and Claude AI

## Output

A JSON object containing the queried IP address, its country code (e.g. 'CN'), a risk score from 0–100 based on AbuseIPDB data, and a 3-sentence AI-generated threat analysis from Claude summarizing the IP's known abuse patterns and risk level.

## Request schema (JSON Schema)

```json
{
 "properties": {
  "input": {
   "required": [
    "method"
   ],
   "properties": {
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "pathParams": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ip": "118.25.6.39",
  "country": "CN",
  "ai_summary": "3-sentence risk analysis from Claude",
  "risk_score": 100
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cyber-intel-api-ip-threat-summary-3ed2e9f3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from cyber-intel-api-production-a3c1.up.railway.app](https://www.zero.xyz/host/cyber-intel-api-production-a3c1.up.railway.app/llms.txt)