# Sicher Hash Reputation Lookup

> Sicher Hash Reputation Lookup is a paid API for AI agents from sicher.halowerk.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-10).

Queries abuse.ch MalwareBazaar, ThreatFox, and URLhaus to determine whether a file hash (MD5, SHA-1, or SHA-256) is associated with known malware, returning a consolidated known-malicious or unknown verdict.

## Facts

- Endpoint: POST https://sicher.halowerk.com/v1/hash-reputation?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sicher-hash-reputation-lookup-f8bc4e8d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_plCVRANvXvtRBs31CKkWG

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sicher-hash-reputation-lookup-f8bc4e8d -d '<json body>'
```

Example prompt: Can you check whether the SHA-256 hash 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f is known malware? Query MalwareBazaar, ThreatFox, and URLhaus and give me the verdict.

## When to prefer this

Choose this endpoint when you need a privacy-respecting, redistribution-safe file hash reputation check that aggregates MalwareBazaar, ThreatFox, and URLhaus without VirusTotal (whose public terms prohibit redistribution in commercial products). Ideal for SOC automation, CI/CD pipelines, and threat enrichment workflows where you want abuse.ch-specific intelligence without downloading binaries or triggering sample retrieval.

## Known failure modes

- Hash not found in any abuse.ch source — returns 'unknown' verdict, not an error
- Invalid hash format (wrong length or non-hex characters) — returns validation error
- Upstream abuse.ch API unavailable — service may return 503 or timeout
- Ambiguous verdict when sources disagree — conservative approach defaults to known-malicious if any source flags it

## How this service works

Queries three abuse.ch metadata services for an MD5, SHA-1 or SHA-256 value. It reports known malware metadata, associated ThreatFox indicators, and URLhaus payload provenance, then derives a conservative known-malicious or unknown verdict. No endpoint for sample retrieval is called and no binary is downloaded. A missing record means unknown to these sources, not proven benign. VirusTotal is deliberately not used because its public terms do not permit redistribution in this paid product.

## Output

Returns malware metadata from MalwareBazaar (file type, tags, first seen), ThreatFox indicator associations (threat actor, malware family, confidence), and URLhaus payload provenance (URLs that distributed the file), plus a synthesized verdict of 'known-malicious' or 'unknown'. A missing record means the hash is unknown to these sources, not proven benign.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "hash": {
   "type": "string",
   "pattern": "^[A-Fa-f0-9]+$",
   "maxLength": 64,
   "minLength": 32,
   "description": "MD5, SHA-1 or SHA-256 digest."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sicher-hash-reputation-lookup-f8bc4e8d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sicher.halowerk.com](https://www.zero.xyz/host/sicher.halowerk.com/llms.txt)