# SiteCheck Web Intel – ipsum Threat Level Checker

> SiteCheck Web Intel – ipsum Threat Level Checker is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-25).

Checks an IPv4 address against the ipsum threat intelligence blocklist and returns its threat level score and listing status

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/ipsum-threat-level?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-25
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-ipsum-threat-level-checker-569b9d52
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ph3zQwwBNBdgnYaZ6LTTN

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-ipsum-threat-level-checker-569b9d52
```

Example prompt: Can you check if the IP address 185.220.101.1 is on the ipsum threat intelligence list and tell me its threat level?

## When to prefer this

Choose this endpoint when you need a quick, pay-per-call IP reputation check against the community-curated ipsum blocklist without requiring API keys or subscriptions. It is particularly useful for lightweight threat triage, SIEM enrichment, or ad-hoc checks on suspicious IPs. For broader multi-source IP reputation (e.g. CI Army / CINS Score), use the sibling CINS Score endpoint instead.

## Known failure modes

- Missing or invalid 'ip' query parameter returns an error
- Non-IPv4 addresses (e.g. IPv6, hostnames) may not be supported
- Payment failure results in no charge and no data returned
- Blocklist source temporarily unavailable may cause stale or failed responses

## How this service works

Checks an IPv4 address against IPsum, an aggregate of public blocklists: returns the number of source feeds that list it (its level, 1 to 8) and whether it is listed at all. A higher level means more feeds agree. Not listed means none of the aggregated feeds list it.

## Output

Returns a JSON object containing the queried IP address, a numeric threat level (higher = more dangerous), a boolean indicating whether the IP is listed in the ipsum blocklist, the source URL of the blocklist, the total number of entries in the list, and the timestamp when the check was performed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IPv4 address such as 185.220.101.1 (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ip": "185.220.101.1",
  "level": 2,
  "listed": true,
  "source": "https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt",
  "entries": 126847,
  "checkedAt": "2026-10-23T09:38:37.620Z"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-ipsum-threat-level-checker-569b9d52/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)