# SiteCheck Web Intel – Cisco Talos IP Reputation

> SiteCheck Web Intel – Cisco Talos IP Reputation is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-24).

Returns Cisco Talos threat reputation data for an IPv4 address, including threat level, web reputation score, DNS match status, owner/location, email volume stats, and neighbouring /24 network reputation breakdown.

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/talos-ip-blacklist?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-24
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-cisco-talos-ip-reputation-0662433c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_poM_50VQLeBpAiABIwSg9

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-cisco-talos-ip-reputation-0662433c
```

Example prompt: Can you check the Cisco Talos reputation for 185.220.101.47 — I want to know if it's flagged as untrusted or poor, its web reputation score, whether its DNS records match, and how bad the surrounding /24 neighbourhood looks?

## When to prefer this

Choose this endpoint when you need Cisco Talos-specific threat intelligence for an IPv4 address, particularly its proprietary threat level label, web reputation score, and email sending volume metrics. Prefer this over generic WHOIS or geolocation lookups when email reputation or spam-related risk is a concern, or when you want neighbourhood context showing how many surrounding IPs in the same /24 are rated unfavorably by Talos.

## Known failure modes

- Invalid or private IPv4 address returns an error or no data
- IPv6 addresses are not supported
- Talos data may be stale if Cisco has not recently scanned the IP
- Rate limiting or payment failure returns a 402 or 429 error
- Cloudflare Worker timeout if upstream Talos service is slow

## How this service works

Cisco Talos reputation for an IPv4 address: threat level (favorable, neutral, poor, untrusted), web reputation score, forward/reverse DNS match, hostname, owner, location, email volume magnitude (daily, monthly and last 30 days), the /24 network's average magnitude and how many neighbouring addresses in that /24 Talos rates untrusted, poor, neutral or favorable.

## Output

A JSON object containing: Talos threat level label (favorable, neutral, poor, or untrusted), numeric web reputation score, forward/reverse DNS match status, resolved hostname, IP owner organisation, geographic location, daily/monthly/last-30-day email volume magnitude, the average magnitude of the /24 network, and counts of how many addresses in the same /24 subnet are rated untrusted, poor, neutral, and favorable.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "Public IPv4 address"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-cisco-talos-ip-reputation-0662433c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)