# NetIntel IP Reputation Analyzer

> NetIntel IP Reputation Analyzer is a paid API for AI agents from netintel.dev, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-14).

Analyzes an IPv4 or IPv6 address for reputation, threat intelligence, and risk scoring by aggregating data from OTX and AbuseIPDB sources

## Facts

- Endpoint: GET https://netintel.dev/ip-reputation/analyze
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/netintel-ip-reputation-analyzer-46ba1356
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_paGi18iJHfeaQpzyK-rBA

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability netintel-ip-reputation-analyzer-46ba1356
```

Example prompt: Can you check the reputation of IP address 185.220.101.45 and tell me if it's malicious, what its risk score is, and what kinds of threats it's associated with?

## When to prefer this

Choose this endpoint when you need a comprehensive, aggregated IP threat assessment combining both OTX and AbuseIPDB signals in a single call, especially when you want a composite risk score and risk level alongside raw source data. Preferred over querying OTX or AbuseIPDB separately when cost efficiency and unified output matter. Well-suited for security automation, firewall rule decisions, or incident response triage.

## Known failure modes

- Invalid IP address format returns a 400 error
- Payment not provided or insufficient USDC balance returns a 402 Payment Required
- IP address not found in any threat intelligence source returns low/zero scores with empty arrays
- Rate limiting or upstream OTX/AbuseIPDB API unavailability may cause 503 or delayed responses
- IPv6 addresses may have less coverage than IPv4 in upstream databases

## How this service works

Check an IP address against AbuseIPDB and AlienVault OTX threat feeds. Returns a composite risk score, threat categories, malware families, and full source data.

## Output

Returns a JSON object containing the queried IP address, OTX threat intelligence data (ASN, reputation score, pulse count, country, threat types, malware families), AbuseIPDB data (ISP, domain, usage type, total reports, confidence score, distinct reporters, last reported date), a composite summary (first/last seen, is_malicious flag, threat categories), a numeric risk_score (0-100), and a risk_level string (e.g. 'critical', 'high', 'medium', 'low').

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IPv4 or IPv6 address to check"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "ip": {
       "type": "string"
      },
      "otx": {
       "type": "object"
      },
      "abuseipdb": {
       "type": "object"
      },
      "composite": {
       "type": "object"
      },
      "risk_level": {
       "type": "string"
      },
      "risk_score": {
       "type": "number",
       "description": "0-100, higher = more malicious"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ip": "185.220.101.45",
  "otx": {
   "asn": "AS53667",
   "available": true,
   "reputation": -100,
   "pulse_count": 38,
   "country_code": "NL",
   "threat_types": [
    "scanning"
   ],
   "malware_families": [
    "Mirai"
   ]
  },
  "abuseipdb": {
   "isp": "Frantech Solutions",
   "domain": "frantech.ca",
   "categories": [
    18,
    14
   ],
   "usage_type": "Data Center/Web Hosting/Transit",
   "total_reports": 1842,
   "confidence_score": 100,
   "last_reported_at": "2024-11-01T14:22:00Z",
   "distinct_reporters": 312
  },
  "composite": {
   "last_seen": "2024-11-01T14:22:00Z",
   "first_seen": "2022-03-11",
   "is_malicious": true,
   "threat_categories": [
    "brute_force",
    "port_scan"
   ]
  },
  "risk_level": "critical",
  "risk_score": 87
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/netintel-ip-reputation-analyzer-46ba1356/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from netintel.dev](https://www.zero.xyz/host/netintel.dev/llms.txt)