# NetIntel IP Blacklist Check

> NetIntel IP Blacklist Check is a paid API for AI agents from netintel.dev, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-15).

Checks an IPv4 address against multiple DNS blacklists and returns a threat score, grade, and per-blacklist listing status

## Facts

- Endpoint: GET https://netintel.dev/ip-blacklist/check
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/netintel-ip-blacklist-check-66538e0a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ouXsvGPbVHV1iIjSHRPmK

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability netintel-ip-blacklist-check-66538e0a
```

Example prompt: Can you check whether the IP 203.0.113.47 is blacklisted anywhere — I want to know its threat level, grade, and which specific blacklists it shows up on?

## When to prefer this

Choose this endpoint when you need a consolidated, multi-blacklist reputation check on a single IPv4 address and want a scored, graded summary alongside per-blacklist detail. Ideal for email security pipelines, firewall enrichment, or incident response workflows where you need to quickly assess whether an IP is flagged for spam, exploits, or other abuse across industry-standard DNS blacklists like Spamhaus ZEN.

## Known failure modes

- Missing or invalid 'ip' query parameter returns an error response
- Non-IPv4 input (IPv6, hostname) may return an error or unexpected result
- Payment failure (insufficient USDC balance) results in HTTP 402 and no data returned
- Temporarily unavailable blacklist providers may reduce total_checked count
- Rate limiting or network issues may cause timeouts

## How this service works

Check an IP address against 15 major DNS blacklists (Spamhaus, Barracuda, SORBS, etc.) simultaneously — returns which lists it appears on, a reputation score, and a threat classification so agents can make block/allow decisions instantly.

## Output

Returns a JSON object with the queried IP, a letter grade (e.g. 'A'), a numeric score (0–100), an overall threat_level string (e.g. 'clean'), a count of how many blacklists it's listed on, the total number checked (e.g. 15), a reversed_ip string, an array of findings, and a per-blacklist array showing each blacklist name, description, and whether the IP is listed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IPv4 address to check (e.g. 1.2.3.4)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "ip": {
       "type": "string"
      },
      "grade": {
       "type": "string"
      },
      "score": {
       "type": "number"
      },
      "findings": {
       "type": "array"
      },
      "blacklists": {
       "type": "array"
      },
      "reversed_ip": {
       "type": "string"
      },
      "listed_count": {
       "type": "number"
      },
      "threat_level": {
       "type": "string"
      },
      "total_checked": {
       "type": "number"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ip": "1.2.3.4",
  "grade": "A",
  "score": 100,
  "findings": [],
  "blacklists": [
   {
    "name": "zen.spamhaus.org",
    "listed": false,
    "description": "Spamhaus ZEN — combined spam sources and exploits"
   }
  ],
  "reversed_ip": "4.3.2.1",
  "listed_count": 0,
  "threat_level": "clean",
  "total_checked": 15
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/netintel-ip-blacklist-check-66538e0a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from netintel.dev](https://www.zero.xyz/host/netintel.dev/llms.txt)