# Threat Reputation API

> Threat Reputation API is a paid API for AI agents from threat-reputation-mcp.hsharmanov02.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-12).

Looks up URL, domain, or IP address threat reputation, returning a verdict (clean/suspicious/malicious), 0–100 risk score, and supporting threat-intel signals from URLhaus, AbuseIPDB, and Spamhaus ZEN.

## Facts

- Endpoint: TOOLS/CALL https://threat-reputation-mcp.hsharmanov02.workers.dev/reputation?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/threat-reputation-api-f66f0477
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_aYnnYqXbyOTfwAiVpayit

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability threat-reputation-api-f66f0477 -d '<json body>'
```

Example prompt: Can you check the threat reputation of https://suspicious-login.example.ru — I need to know if it's clean, suspicious, or malicious, and what the risk score is?

## When to prefer this

Choose this endpoint when you need a fast, pay-per-call threat reputation verdict on a URL, domain, or IP without setting up an API key — ideal for agents that need occasional on-demand threat checks with no subscription commitment. It aggregates multiple threat-intel sources (URLhaus, AbuseIPDB, Spamhaus ZEN) into a single scored response, saving the overhead of querying each source separately. Prefer this over single-source lookups when you want a composite risk score and multi-signal corroboration.

## Known failure modes

- HTTP 402 returned if payment is not provided — includes machine-readable payment instructions for x402 v2 (EIP-3009 on Base)
- Invalid or malformed URL/IP/domain input may return an error or null signals
- AbuseIPDB confidence may be null if the IP has no recorded abuse history
- Domain age unavailable for very new or private domains
- Rate limits or quota exhaustion if the underlying threat-intel sources are unreachable

## How this service works

URL/domain/IP threat-reputation lookup: verdict (clean|suspicious|malicious), 0-100 risk score, and the threat-intel signals behind it (URLhaus, AbuseIPDB, Spamhaus ZEN). Paid per call: $0.01 USDC on Base (eip155:8453) via x402 v2 (exact scheme, EIP-3009). Unpaid requests return HTTP 402 with machine-readable payment instructions; the buyer signs the EIP-3009 authorization off-chain and retries with the PAYMENT-SIGNATURE header. The facilitator pays the gas, so the buyer needs no ETH. No API key.

## Output

Returns a JSON object with the queried input, a verdict string ('clean', 'suspicious', or 'malicious'), an integer risk score from 0 to 100, a set of threat-intel signals (URLhaus listing boolean, domain age in days, Spamhaus ZEN listing boolean, AbuseIPDB confidence score), and an ISO 8601 timestamp of when the check was performed.

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "input": "https://example.com/login",
  "score": 0,
  "signals": {
   "urlhaus_listed": false,
   "domain_age_days": 11231,
   "spamhaus_listed": false,
   "abuseipdb_confidence": null
  },
  "verdict": "clean",
  "checked_at": "2026-09-29T10:00:00.000Z"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/threat-reputation-api-f66f0477/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from threat-reputation-mcp.hsharmanov02.workers.dev](https://www.zero.xyz/host/threat-reputation-mcp.hsharmanov02.workers.dev/llms.txt)