# Grokzilla IP Intelligence > Grokzilla IP Intelligence is a paid API for AI agents from grokzilla.shop, paid per call via x402, $0.0033/call, status unknown (last checked 2026-10-30). Enriches a public IPv4/IPv6 address or CIDR with network normalization, size, CIDR membership checks, WHOIS holder, abuse contact, origin ASN from RIR RDAP/RIPEstat, and country from DB-IP Lite. ## Facts - Endpoint: POST https://grokzilla.shop/api/skills/ip-intel?utm_source=zero.xyz - Price: $0.0033/call - Payment: x402 - Status: unknown - Last checked: 2026-10-30 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/grokzilla-ip-intelligence-6209234a - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_8vzHt7miWh6pQ_ix6WpLC Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability grokzilla-ip-intelligence-6209234a -d '' ``` Example prompt: Look up 198.51.100.42 — I need the network it belongs to, who holds the block, the abuse contact, origin ASN, and which country it's in, and also check whether 198.51.100.10 and 198.51.100.200 are in the same CIDR. ## When to prefer this Choose this endpoint when you need a single call that combines network normalization, subnet membership testing, and authoritative RIR/RIPEstat registration metadata (holder, ASN, abuse contact) alongside DB-IP country data — rather than calling separate WHOIS, geolocation, and routing APIs independently. Especially useful for abuse triage, firewall automation, threat intel enrichment, and compliance workflows where you need structured, machine-readable output. The no-charge-on-registry-failure guarantee reduces risk for automated pipelines. ## Known failure modes - Private or reserved IP ranges are rejected before payment with a 4xx error - If RIR RDAP or RIPEstat registries are unavailable, the call returns an error and is not charged - Malformed IP or CIDR input (e.g. too long, invalid format) rejected at schema validation - CIDR membership check list limited to 50 IPs; exceeding this causes a validation error - Some IPs may have incomplete WHOIS records if the RIR has sparse registration data ## How this service works One public IP or CIDR in: normalized network, size, membership checks, plus holder, abuse contact and origin ASN from RIR RDAP and RIPEstat, and country from DB-IP Lite (CC BY 4.0, attributed). Private ranges refused before payment. Not charged if registries fail. ## Output Returns normalized CIDR network, network size, boolean membership results for each checked IP, registered holder name, abuse contact, origin ASN number and name (from RIR RDAP and RIPEstat), and country code/name (from DB-IP Lite). Private/RFC-1918 ranges are rejected before payment. If RIR registries are unreachable, no charge is incurred. The request_id is echoed back for idempotency tracking. ## Request schema (JSON Schema) ```json { "type": "object", "properties": { "check": { "type": "array", "items": { "type": "string", "maxLength": 45 }, "maxItems": 50, "description": "IPs to test for membership in the network" }, "query": { "type": "string", "maxLength": 64, "minLength": 2, "description": "IPv4/IPv6 address or CIDR" }, "request_id": { "type": "string", "pattern": "^[A-Za-z0-9._:-]+$", "maxLength": 64, "minLength": 1, "description": "Optional idempotency key. Echoed back; a credit-pack redemption with the same request_id and body is charged once." } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "ok": true, "data": { "geo": { "country": "US", "dataset": "DB-IP IP-to-Country Lite 2026-10", "attribution": { "url": "https://db-ip.com", "text": "IP Geolocation by DB-IP", "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)" }, "countries_at_edges": [ "US" ] }, "network": { "last": "8.8.8.8", "first": "8.8.8.8", "query": "8.8.8.8", "network": "8.8.8.8/32", "version": 4, "is_global": true, "num_addresses": "1", "prefix_length": 32, "reverse_pointer": "8.8.8.8.in-addr.arpa", "is_single_address": true }, "routing": { "asns": [ 15169 ], "as_holder": "GOOGLE - Google LLC", "routed_prefix": "8.8.8.0/24" }, "registry": { "name": "GOGL", "type": "DIRECT ALLOCATION", "cidrs": [ "8.8.8.0/24" ], "handle": "NET-8-8-8-0-2", "holder": "Google LLC", "registered": "2023-12-28T17:24:33-05:00", "abuse_email": "network-abuse@google.com", "end_address": "8.8.8.255", "last_changed": "2023-12-28T17:24:56-05:00", "start_address": "8.8.8.0", "registry_country": null, "origin_asns_registered": null } }, "next": [ "email_check" ], "skill": "ip_intel", "charged": true, "service": "ip_intel", "sources": [ { "url": "https://rdap.arin.net/registry/ip/8.8.8.8", "name": "RIR RDAP (via rdap.org bootstrap)", "fetched_at": "2026-10-17T11:12:56Z" }, { "url": "https://stat.ripe.net/data/network-info/data.json?resource=8.8.8.8", "name": "RIPEstat network-info / as-overview", "fetched_at": "2026-10-17T11:12:56Z" }, { "url": "https://db-ip.com", "name": "IP Geolocation by DB-IP", "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)", "fetched_at": "2026-10-17T11:12:56Z", "dataset_month": "2026-10" } ], "summary": "8.8.8.8/32: AS15169 GOOGLE - Google LLC, Google LLC, US", "version": "1.0.0", "warnings": [ "country is DB-IP Lite geolocation (country-level, monthly); it can differ from the registry country" ], "confidence": 0.9, "data_as_of": "2026-10-17T11:12:56Z", "attribution": { "url": "https://db-ip.com", "text": "IP Geolocation by DB-IP", "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)" }, "generated_at": "2026-10-17T11:12:56Z" } } ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/grokzilla-ip-intelligence-6209234a/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from grokzilla.shop](https://www.zero.xyz/host/grokzilla.shop/llms.txt)