# RelayShield ScamKit Match

> RelayShield ScamKit Match is a paid API for AI agents from api.relayshield.net, paid per call via x402, $0.1/call, status unknown (last checked 2026-10-30).

Matches a scam kit fingerprint ID against a threat intelligence database to identify known phishing/scam kit families and their sighting history

## Facts

- Endpoint: POST https://api.relayshield.net/v1/payg/scamkit-match?utm_source=zero.xyz
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/relayshield-scamkit-match-5336744f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_nE5cYB18wJrJyA8pXexFC

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability relayshield-scamkit-match-5336744f -d '<json body>'
```

Example prompt: I just detected a scam kit with fingerprint ID kit_9f2c4a1b3d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f8 — can you check if it's a known phishing kit family and tell me the confidence score and how many times it's been spotted?

## When to prefer this

Use this endpoint when you have already computed or extracted a scam kit fingerprint (kit_<sha256> format) and need to rapidly classify it against a live threat intelligence database backed by 725K indicators and 129 monitored criminal marketplaces. Prefer this over generic URL or phone-number lookups when the artifact in hand is a kit fingerprint hash specifically. Best suited for SOC automation, agentic commerce fraud screening, and smishing/phishing campaign triage pipelines.

## Known failure modes

- Unknown fingerprint ID returns no match or low-confidence verdict
- Malformed kit_<sha256> fingerprint format causes validation error
- Fingerprint not yet indexed in the 725K indicator database returns empty result
- Network timeout or service unavailability returns HTTP error
- Invalid input schema (missing fingerprint_id field) causes 400 error

## How this service works

Identity security, threat monitoring and intelligence for the agentic AI era. TAP verifier for agentic commerce, MCP Proxy Firewall for AI agents, and threat intelligence APIs backed by 725K indicators across 129 monitored marketplaces.

## Output

Returns a JSON object with a verdict (e.g. 'known_kit'), a confidence score between 0 and 1, the kit family name (e.g. 'parcel-smish-eu-04'), the matched fingerprint ID, and the number of times this kit has been sighted across monitored criminal marketplaces.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "fingerprint_id": {
   "type": "string",
   "description": "kit_<sha256> fingerprint ID to match"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "data": {
   "verdict": "known_kit",
   "confidence": 0.92,
   "kit_family": "parcel-smish-eu-04",
   "fingerprint_id": "kit_9f2c4a1b3d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f8",
   "sightings_count": 7
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/relayshield-scamkit-match-5336744f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.relayshield.net](https://www.zero.xyz/host/api.relayshield.net/llms.txt)