# Domain Cyberattack Target Risk Scorer

> Domain Cyberattack Target Risk Scorer is a paid API for AI agents from atq6wtkp6k.execute-api.us-east-1.amazonaws.com, paid per call via x402, $0.5/call, status unknown (last checked 2026-09-16).

Scores a domain's probability of being an active or upcoming cyberattack target using a 6-signal correlation model covering breach, infostealer, ransomware, session, CVE, and threat-actor targeting history.

## Facts

- Endpoint: POST https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/target-risk
- Price: $0.5/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/domain-cyberattack-target-risk-scorer-0fc873c9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_0kTud211OkN-Yhs6pHII5

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability domain-cyberattack-target-risk-scorer-0fc873c9 -d '<json body>'
```

Example prompt: Can you run a proactive cyberattack target risk assessment on acme.com and tell me the risk score, probability tier, and which of the six signals — breach, infostealer, ransomware, session, CVE, and threat-actor targeting — are firing?

## When to prefer this

Use this endpoint when you need proactive, forward-looking attack targeting risk rather than purely retrospective breach checking. It is especially valuable for security triage workflows where you want to prioritize which domains are most likely to be targeted next, vendor risk assessments, M&A due diligence, and threat hunting. Prefer this over a simple breach-check endpoint when you need multi-signal correlation including threat-actor history, ransomware gang activity, and CVE exposure together in a single score.

## Known failure modes

- Missing or malformed domain input returns a validation error
- Domain with no threat intelligence data may return a low score with empty signals array
- Rate limiting or quota exhaustion returns an error if too many calls are made
- Payment failure ($0.50 USDC per call) results in request rejection
- Invalid domain format (e.g. bare IP or non-existent TLD) may return an error or zero-score result

## How this service works

Score a domain's probability of being an active or upcoming cyberattack target using a 6-signal correlation model (breach, infostealer, ransomware, session, CVE, and threat-actor targeting history). Call for proactive risk triage, not just after-the-fact breach checking.

## Output

Returns a JSON object containing the queried domain, a target_risk_score integer (0–100), a probability_tier string indicating attack likelihood category, and a signals array detailing the status of each of the six correlation signals (breach exposure, infostealer data, ransomware history, session compromise, CVE exposure, and threat-actor targeting history).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "description": "Domain to score (e.g. acme.com)"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/domain-cyberattack-target-risk-scorer-0fc873c9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from atq6wtkp6k.execute-api.us-east-1.amazonaws.com](https://www.zero.xyz/host/atq6wtkp6k.execute-api.us-east-1.amazonaws.com/llms.txt)