# RelayShield Infostealer Check

> RelayShield Infostealer Check is a paid API for AI agents from atq6wtkp6k.execute-api.us-east-1.amazonaws.com, paid per call via x402, $0.15/call, status unknown (last checked 2026-09-15).

Checks whether a given email address has been found in infostealer malware logs or credential theft datasets

## Facts

- Endpoint: POST https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/infostealer
- Price: $0.15/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/relayshield-infostealer-check-45e0e787
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_3CHWnAi0vghfuL5YNPuLK

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability relayshield-infostealer-check-45e0e787 -d '<json body>'
```

Example prompt: Can you check whether john.doe@company.com has shown up in any infostealer malware logs or credential theft databases?

## When to prefer this

Use this endpoint when you need to determine if a specific email address has been harvested by infostealer malware (e.g. RedLine, Raccoon, Vidar) and its credentials may be compromised. Prefer this over general breach-check services when the specific concern is infostealer campaigns rather than traditional data breach dumps. Useful for security teams onboarding new users, investigating account takeover risk, or screening high-value accounts for credential exposure.

## Known failure modes

- Invalid or malformed email address returns validation error
- Email not found returns found:false with empty stealers array
- Service unavailable or timeout from upstream threat intelligence source
- Authentication or payment failure blocks the request
- Rate limiting if too many requests are made in a short period

## How this service works

Check whether an email address's credentials were harvested by infostealer malware and appear in a criminal stealer-log marketplace — detected 24-72 hours ahead of public breach databases. Call to catch device-level compromise before stolen session cookies or saved passwords are used for account takeover.

## Output

Returns a JSON object indicating whether the email was found in infostealer data, a boolean 'found' flag, a list of stealer names that captured it, and a count of how many stealers recorded this email.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "email": {
   "type": "string",
   "description": "Email address to check for infostealer compromise"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/relayshield-infostealer-check-45e0e787/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from atq6wtkp6k.execute-api.us-east-1.amazonaws.com](https://www.zero.xyz/host/atq6wtkp6k.execute-api.us-east-1.amazonaws.com/llms.txt)