# SiteCheck Web Intel – ThreatFox IOC Lookup

> SiteCheck Web Intel – ThreatFox IOC Lookup is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-25).

Searches abuse.ch ThreatFox for indicators of compromise (IPs, domains, URLs, hashes) returning IOC details, malware family, threat type, confidence score, first/last seen, and Malpedia link.

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/threatfox-iocs?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-25
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-threatfox-ioc-lookup-bf3ee5bc
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_h6lOL5Jbw__A8gRw-17P9

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-threatfox-ioc-lookup-bf3ee5bc
```

Example prompt: Can you check ThreatFox on abuse.ch to see if the IP 185.220.101.45 is a known indicator of compromise — I want to know the malware family, threat type, and confidence score, and only show results from the last 90 days.

## When to prefer this

Choose this endpoint when you need structured, curated threat intelligence from abuse.ch ThreatFox specifically — particularly for correlating IPs, domains, URLs, or file hashes against a community-reported malware IOC database with confidence scoring and Malpedia links. Prefer it over generic WHOIS or IP-reputation checks when you need malware family attribution, threat type classification, or reporter provenance. Complements the sibling URLhaus host-check endpoint (which focuses on active malware distribution hosts) by providing broader IOC coverage across multiple threat types.

## Known failure modes

- No results returned if the indicator has never been reported to ThreatFox
- Partial matches may return unrelated IOCs if exact=false and the term is short or generic
- days parameter out of range (not 1–365) may cause an error or be ignored
- Network timeout if the ThreatFox upstream API is slow or unavailable
- Malformed input (e.g. invalid hash format or non-ASCII domain) may return an empty result or error

## How this service works

Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confidence, first/last seen, reporter, tags and Malpedia link. Optional exact match and a first-seen window in days.

## Output

Returns a list of matching IOC records from ThreatFox, each containing: the IOC value and type (e.g. ip:port, domain, url, hash), associated malware family name, threat type (e.g. botnet_cc, payload_delivery), confidence level (0–100), first and last seen timestamps, the reporter's alias, any associated tags, and a Malpedia link for further malware research context.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "term"
     ],
     "properties": {
      "days": {
       "type": "string",
       "description": "Only IOCs first seen in the last N days, 1 to 365 (default: no limit)"
      },
      "term": {
       "type": "string",
       "description": "An IP, IP:port, domain, URL or hash to look for (required)"
      },
      "exact": {
       "type": "string",
       "description": "true for exact match only (default false: partial match)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-threatfox-ioc-lookup-bf3ee5bc/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)