# CyberPulse OSINT Domain & IP Intelligence

> CyberPulse OSINT Domain & IP Intelligence is a paid API for AI agents from cyberpulse-six.vercel.app, paid per call via x402, $0.15/call, status unknown (last checked 2026-09-16).

Returns open-source intelligence on any domain or IP including open ports, known CVEs, DNS/email posture (SPF/DMARC/DKIM), SSL grade, threat-feed status, and geolocation.

## Facts

- Endpoint: GET https://cyberpulse-six.vercel.app/api/cyber/osint
- Price: $0.15/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cyberpulse-osint-domain-ip-intelligence-8ea0d863
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_V4vZPBaDvKSbkpVAZ6l6H

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cyberpulse-osint-domain-ip-intelligence-8ea0d863
```

Example prompt: Can you run a full OSINT scan on the domain example.com — I need to see its open ports, any known CVEs, SSL grade, whether SPF/DMARC/DKIM are set up, whether it's on any threat feeds, and where it's geolocated?

## When to prefer this

Choose this endpoint when you need a comprehensive, multi-signal OSINT snapshot of a single domain or IP in one call, combining port/CVE data, email security posture, SSL grading, and threat-feed status. Prefer it over dedicated tools when you want defensive intelligence without making multiple upstream API calls yourself.

## Known failure modes

- Domain or IP not found in Shodan or threat feeds — partial or empty results returned
- Invalid domain or IP format — 400 bad request
- Payment not processed — 402 payment required
- Shodan InternetDB rate limits or upstream unavailability — 503 or timeout
- Private/RFC1918 IP addresses may return no meaningful OSINT data

## How this service works

OSINT lookup for any domain or IP — open ports and known CVEs (Shodan InternetDB), DNS and email posture (SPF/DMARC/DKIM), SSL grade, threat-feed status, and geolocation, for security and defensive agents. Authorized defensive use only.

## Output

Returns a structured intelligence report including: open ports and associated services from Shodan InternetDB, known CVEs for the target, DNS email security posture (SPF, DMARC, DKIM presence and validity), SSL certificate grade, threat-feed membership status, and geolocation data for the IP or domain.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "lang": {
       "type": "string",
       "description": "en | es | fr | de | ja | zh | ko | pt | ar | hi (default: en)"
      },
      "target": {
       "type": "string",
       "description": "Domain or IP address — e.g. \"example.com\" | \"8.8.8.8\" | \"shopify.com\" | \"192.168.1.1\" (public IPs only)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "errors": {
     "type": "object",
     "description": "Documented error responses, keyed by HTTP status code",
     "additionalProperties": {
      "type": "object",
      "required": [
       "description"
      ],
      "properties": {
       "example": {
        "type": "object"
       },
       "description": {
        "type": "string"
       }
      }
     }
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "target": "example.com",
  "target_type": "domain",
  "risk_summary": "Domain has minimal exposure. Good email security posture. No known vulnerabilities.",
  "network_exposure": {
   "open_ports": [
    80,
    443
   ],
   "cdn_detected": true,
   "cdn_provider": "Cloudflare",
   "high_risk_ports": [],
   "services_detected": [
    "nginx/1.18"
   ]
  },
  "domain_intelligence": {
   "ssl_grade": "A+",
   "spf_configured": true,
   "dmarc_configured": true,
   "email_security_grade": "A"
  },
  "vulnerability_exposure": {
   "cve_count": 0,
   "known_cves": [],
   "risk_level": "CLEAN"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cyberpulse-osint-domain-ip-intelligence-8ea0d863/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from cyberpulse-six.vercel.app](https://www.zero.xyz/host/cyberpulse-six.vercel.app/llms.txt)