# OrionCMD Bulk Threat Check

> OrionCMD Bulk Threat Check is a paid API for AI agents from api.orioncmd.com, paid per call via x402, $0.5/call, status unknown (last checked 2026-10-18).

Check up to 100 domains or IPv4 addresses in bulk against threat intelligence databases for malicious listings and security risks

## Facts

- Endpoint: GET https://api.orioncmd.com/v1/bulk-threat-check?utm_source=zero.xyz
- Price: $0.5/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-18
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/orioncmd-bulk-threat-check-dac81e37
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_bSspb98yAvZPdxh59DH21

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability orioncmd-bulk-threat-check-dac81e37
```

Example prompt: Can you run a bulk threat check on these domains and IPs — example.com, 192.168.1.1, malware-site.net — and tell me which ones are flagged as threats or associated with ransomware?

## When to prefer this

Choose this endpoint when you need to check multiple domains or IPs (up to 100) in a single call against threat intelligence data including ransomware claims and evidence-backed security reports. Prefer it over single-item checks for batch workflows, and over generic WHOIS or DNS tools when threat listing status and ransomware intelligence are the primary concern.

## Known failure modes

- Missing or empty 'q' query parameter returns an error
- More than 100 items submitted exceeds the bulk limit
- Malformed domain or IP format may cause parsing errors or be skipped
- Network timeouts if DNS resolution for queried items fails
- Payment failure via x402 protocol blocks the request

## How this service works

OrionCMD Checks: Bulk IOC check: up to 100 domains or IPv4 (domains resolved, IPs matched too). Up to 100 comma- or newline-separated domains, URLs or IPv4 addresses in ?q=. Each domain is resolved (A) and the name, parent domains and resolved IPv4 are matched against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed hourly). No ransomware-claim lookups (use /v1/threat-check). Stale feed answers 503 before payment.

## Output

A JSON report labeled 'bulk_threat_check' containing per-item results with: the queried item (domain or IP), its classified type, whether it is listed in threat intelligence feeds, any threat matches found, and resolved IPv4 addresses. Also includes aggregate counts for total items checked and how many are listed as threats.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "q"
     ],
     "properties": {
      "q": {
       "type": "string",
       "description": "Up to 100 domains/IPv4, comma separated"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "report": "bulk_threat_check",
  "results": [
   {
    "item": "example.com",
    "type": "domain",
    "listed": false,
    "matches": [],
    "resolved_ipv4": [
     "93.184.215.14"
    ]
   }
  ],
  "item_count": 2,
  "listed_count": 0
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/orioncmd-bulk-threat-check-dac81e37/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.orioncmd.com](https://www.zero.xyz/host/api.orioncmd.com/llms.txt)