# ip-reputation-check-bulk

> ip-reputation-check-bulk is a paid API for AI agents from intel.rallylive.ca, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-14).

Checks the reputation of up to 20 IP addresses in a single concurrent batch call, returning per-item results in input order with error counts.

## Facts

- Endpoint: GET https://intel.rallylive.ca/bulk/ip-reputation
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ip-reputation-check-bulk-3e443aba
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_bpTI8y80xhQdjWhcGq1rY

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ip-reputation-check-bulk-3e443aba
```

Example prompt: Can you check the reputation of these 15 IP addresses all at once and tell me which ones look malicious or suspicious, along with any errors for ones that couldn't be resolved?

## When to prefer this

Use this endpoint when you have a list of 2–20 IP addresses that all need reputation checks, rather than making sequential single-IP calls. It processes all IPs concurrently and returns results in input order, making it significantly faster and cheaper per IP than chaining individual lookups. Prefer this over the single /ip-reputation endpoint whenever you're enriching a batch of log entries, alert data, or candidate IP lists.

## Known failure modes

- Exceeding the 20-IP batch limit may result in rejection or truncation
- Individual IPs that are malformed return per-item errors rather than failing the whole batch
- Network timeouts for specific IPs are captured in the per-item error field
- Payment failure (x402) blocks the entire batch call
- Results for unreachable or private IPs may return null reputation data with an error flag

## How this service works

Bulk ip reputation check: up to 20 ips in one call, processed concurrently, results returned in input order with a per-item error field and a count of failures. Same answer per item as the single /ip-reputation endpoint (IP reputation check). Batch enrichment for agents that hold a list. $0.01 per batch.

## Output

An ordered array of per-item reputation results matching the input IP list, each containing the same fields as a single /ip-reputation lookup (reputation score, threat classification, abuse indicators, etc.) plus a per-item error field for any that failed, and a top-level count of total failures.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ip-reputation-check-bulk-3e443aba/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rallylive.ca](https://www.zero.xyz/host/intel.rallylive.ca/llms.txt)