# Saylor Innovations Data Desk – IP Threat Feed Checker

> Saylor Innovations Data Desk – IP Threat Feed Checker is a paid API for AI agents from saylorinnovations.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-18).

Checks a single IP address against Feodo Tracker botnet C2, Emerging Threats compromised hosts, and the Tor exit node list, returning a combined verdict and detailed matches

## Facts

- Endpoint: GET https://saylorinnovations.com/api/net/threat-feeds?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-18
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/saylor-innovations-data-desk-ip-threat-feed-checker-7e1725b6
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_gIEYft1kKpxy0h1vcXFpa

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability saylor-innovations-data-desk-ip-threat-feed-checker-7e1725b6
```

Example prompt: Can you check whether the IP address 185.220.101.45 is flagged on any threat feeds — specifically Feodo Tracker, Emerging Threats compromised hosts, or the Tor exit node list — and give me an overall verdict?

## When to prefer this

Choose this endpoint when you need a quick, multi-feed threat intelligence verdict on a single IP address without setting up your own threat feed subscriptions. It is ideal for lightweight triage — combining Feodo Tracker botnet C2, Emerging Threats compromised hosts, and Tor exit node checks in one call — rather than deep OSINT enrichment. Prefer it over full OSINT platforms when you only need a fast pass/fail signal for network security decisions at low cost.

## Known failure modes

- Missing or invalid 'ip' query parameter returns an error
- Private or reserved IP ranges may produce empty results or a note caveat
- Threat feed data may have a freshness lag, so very recent C2 IPs might not yet appear
- IPv6 addresses may have limited coverage depending on feed sources
- Network timeout or upstream feed unavailability could cause a 5xx error

## How this service works

Check an IP against the Feodo Tracker botnet C2 list, Emerging Threats compromised hosts and the Tor exit list with a combined verdict and matches

## Output

Returns a JSON object with the queried IP, its version (4 or 6), an overall verdict string summarising the risk assessment, an array of matching entries from the checked lists, the count of lists matched, the names of all lists checked, and an optional note providing context or caveats for interpreting the result.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "Public IPv4 or IPv6 address"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "json"
    },
    "example": {
     "type": "object",
     "required": [
      "ip",
      "verdict",
      "matches"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IP address"
      },
      "note": {
       "type": "string",
       "description": "Caveat or context for reading the result"
      },
      "source": {
       "type": "string",
       "description": "Data source the values come from"
      },
      "matches": {
       "type": "array",
       "description": "Matching items"
      },
      "verdict": {
       "type": "string",
       "description": "Overall assessment derived from the listed reasons"
      },
      "ip_version": {
       "type": "number",
       "description": "Ip version"
      },
      "lists_checked": {
       "type": "array",
       "description": "Lists checked"
      },
      "lists_matched": {
       "type": "number",
       "description": "Lists matched"
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/saylor-innovations-data-desk-ip-threat-feed-checker-7e1725b6/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from saylorinnovations.com](https://www.zero.xyz/host/saylorinnovations.com/llms.txt)