# RelayShield IP Intelligence

> RelayShield IP Intelligence is a paid API for AI agents from api.relayshield.net, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-14).

Looks up reputation, DNS resolutions, and threat votes for a given IP address or domain

## Facts

- Endpoint: POST https://api.relayshield.net/v1/payg/ip-intel
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/relayshield-ip-intelligence-b4eca6ae
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_dl83DAjHtNxNB4SD2a56y

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability relayshield-ip-intelligence-b4eca6ae -d '<json body>'
```

Example prompt: Can you check the reputation and threat intelligence for the domain acme.com — I want to know if it has any malicious or suspicious votes and what IPs it resolves to?

## When to prefer this

Choose this endpoint when you need fast, pay-per-query IP and domain threat intelligence without a subscription — especially useful in agentic workflows that need to validate untrusted network entities on-demand, check reputation scores before making outbound connections, or triage security alerts involving unknown IPs or domains.

## Known failure modes

- Invalid IP or domain format returns an error response
- Unknown or unindexed domain may return empty resolutions array
- Service unavailable returns a non-ok response
- Payment not attached or insufficient USDC returns 402 payment required
- Rate limiting may occur for high-volume queries

## How this service works

RelayShield Landing Site

## Output

Returns a JSON object with a boolean ok flag, the queried entity (IP or domain), query type, a numeric reputation score, a list of dated DNS resolutions with resolved IP addresses, plus counts of malicious and suspicious community votes.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ip": {
   "type": "string",
   "description": "Alternative: IP address to look up (returns reputation + reverse passive DNS)"
  },
  "domain": {
   "type": "string",
   "description": "Domain to look up (returns reputation + passive DNS resolution history)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "data": {
   "queried": "acme.com",
   "query_type": "domain",
   "reputation": 0,
   "resolutions": [
    {
     "date": "2026-06-01T00:00:00+00:00",
     "ip_address": "93.184.216.34"
    }
   ],
   "malicious_votes": 0,
   "suspicious_votes": 0
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/relayshield-ip-intelligence-b4eca6ae/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.relayshield.net](https://www.zero.xyz/host/api.relayshield.net/llms.txt)