# SYNTHORA OSINT Risk Bundle

> SYNTHORA OSINT Risk Bundle is a paid API for AI agents from osint.hergertsynthora.com, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-14).

Fuses five OSINT intel feeds (Shodan, Censys, crt.sh, HaveIBeenPwned, OFAC sanctions) into a unified 0-100 risk score with CLEAN/LOW/MEDIUM/HIGH/CRITICAL verdict for any domain, IP, name, or email.

## Facts

- Endpoint: POST https://osint.hergertsynthora.com/service
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/synthora-osint-risk-bundle-8e210d9e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_daiKPcYftPzM2ovuwKd5K

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability synthora-osint-risk-bundle-8e210d9e -d '<json body>'
```

Example prompt: Run a full OSINT risk check on acmecorp.com — I want the combined 0-100 risk score, the CLEAN/LOW/MEDIUM/HIGH/CRITICAL verdict, and a breakdown of what each intel source found including any breach or sanctions hits.

## When to prefer this

Choose this endpoint when you need a single-call, multi-source OSINT risk summary rather than querying Shodan, Censys, HaveIBeenPwned, and OFAC separately. It is ideal for automated due diligence pipelines, vendor risk screening, or rapid threat triage where a normalized 0-100 score and categorical verdict are more actionable than raw feed data. Prefer it over single-source breach checkers or infrastructure scanners when breadth of coverage and unified scoring matter more than deep single-source detail.

## Known failure modes

- Invalid or malformed target string returns an error (non-domain, non-IP, non-email format)
- Target not found in any feed returns a CLEAN verdict with zero hits — may be a false negative for obscure targets
- OFAC or HaveIBeenPwned feed staleness may reduce verdict accuracy if feeds are not recently refreshed
- Payment failure via x402/Base returns a 402 error before any data is returned
- Rate limiting or upstream feed timeouts may result in partial results or degraded coverage

## How this service works

OSINT Risk Bundle: ONE call fuses 5 SYNTHORA intel feeds (Shodan + Censys infra exposure, crt.sh CT certificates, HaveIBeenPwned breach corpus, OFAC sanctions snapshot) into a unified 0-100 risk score with CLEAN/LOW/MEDIUM/HIGH/CRITICAL verdict, per-source breakdown, hits and feed-freshness coverage. POST {"target":"domain|ip|name|email"}. 0.10 USDC via x402 on Base.

## Output

A JSON object containing a 0-100 integer risk score, a categorical verdict (CLEAN/LOW/MEDIUM/HIGH/CRITICAL), a per-source breakdown showing hits and findings from Shodan infrastructure scan, Censys exposure data, crt.sh certificate transparency logs, HaveIBeenPwned breach corpus, and OFAC sanctions snapshot, plus feed freshness/coverage metadata and a payment receipt.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "target": {
   "type": "string",
   "description": "domain, IP, name or email to assess"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "niche": "osint",
  "result": {},
  "receipt": {}
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/synthora-osint-risk-bundle-8e210d9e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from osint.hergertsynthora.com](https://www.zero.xyz/host/osint.hergertsynthora.com/llms.txt)