# SiteCheck Web Intel – SSL Blacklist Certificate Lookup

> SiteCheck Web Intel – SSL Blacklist Certificate Lookup is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-24).

Checks a certificate SHA-1 fingerprint against the abuse.ch SSL Blacklist to determine if it has been linked to malware botnet C2 servers

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/sslbl-abuse-certs?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-24
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-ssl-blacklist-certificate-lookup-82db2e94
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_jfCYB4AklHdeTxg_dsIP0

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-ssl-blacklist-certificate-lookup-82db2e94
```

Example prompt: Check if the certificate with SHA-1 fingerprint 38151a6b2438b2b645a27a891e1e15786f11a783 is on the abuse.ch SSL blacklist — I want to know if it's been flagged for malware or C2 activity and when it was added.

## When to prefer this

Use this endpoint when you have a specific TLS/SSL certificate SHA-1 fingerprint and need to quickly check it against the abuse.ch SSL Blacklist, a well-known threat intelligence feed focused on malware botnet command-and-control certificates. Prefer this over generic certificate validation tools when the goal is threat intelligence lookup rather than certificate validity checking. Best suited for security operations, incident response, or automated threat enrichment pipelines where checking certificate reputation against a curated malware C2 list is needed.

## Known failure modes

- Certificate not found in list returns listed:false with no entry details — does not indicate the certificate is safe, only that it is not on this specific list
- Invalid SHA-1 fingerprint format (not 40 hex characters) may return an error or no results
- List coverage is limited to certificates tracked by abuse.ch SSLBL — many malicious certificates may not be included
- Stale list data if the upstream abuse.ch list has not been recently synced
- Network timeout or upstream API unavailability from abuse.ch infrastructure

## How this service works

Checks a certificate SHA-1 fingerprint (40 hex characters) against the abuse.ch SSL Blacklist of certificates seen on malware botnet C2 servers. A hit returns the date added and the malware reason from the list. Only certificates this list tracks are covered.

## Output

Returns a JSON object indicating whether the certificate is listed (true/false), the date it was added to the blacklist, the associated malware/reason string (e.g. 'PureLogsStealer C&C'), the source URL of the blacklist, the total number of entries in the list, and the timestamp when the check was performed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "sha1"
     ],
     "properties": {
      "sha1": {
       "type": "string",
       "description": "Certificate SHA-1 fingerprint, 40 hex characters (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "sha1": "38151a6b2438b2b645a27a891e1e15786f11a783",
  "entry": {
   "added": "2026-10-18 12:25:30",
   "reason": "PureLogsStealer C&C"
  },
  "listed": true,
  "source": "https://sslbl.abuse.ch/blacklist/sslblacklist.csv",
  "listSize": 11032,
  "checkedAt": "2026-10-23T09:38:37.077Z"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-ssl-blacklist-certificate-lookup-82db2e94/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)