# Vextorium Malicious IP Checker

> Vextorium Malicious IP Checker is a paid API for AI agents from api.vextorium.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-19).

Checks a given IP address against public threat intelligence lists (abuse.ch Feodo Tracker, Tor exit nodes, Spamhaus DROP) and returns risk level and findings.

## Facts

- Endpoint: POST https://api.vextorium.com/v1/malicious-ip?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-19
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/vextorium-malicious-ip-checker-b3690447
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_eSsp1lw-QFQePLvp6C7k8

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability vextorium-malicious-ip-checker-b3690447 -d '<json body>'
```

Example prompt: Can you check if the IP 185.220.101.45 is on any known threat lists — like botnet C2 servers, Tor exit nodes, or spam networks — before I allow it to sign up?

## When to prefer this

Use this endpoint when you need a fast, low-cost IP reputation check against well-known public threat lists (Feodo Tracker botnet C2s, Tor exit nodes, Spamhaus DROP spam/hijacked networks) for filtering sign-ups, payments, or inbound traffic. Prefer this over broader IP geolocation or full OSINT tools when the specific goal is threat-list membership screening rather than general IP enrichment.

## Known failure modes

- Invalid IP format returns an error or unexpected result
- Private/reserved IP addresses flagged as private rather than checked against lists
- Threat lists may not be real-time; newly listed IPs may not yet appear
- Clean result does not guarantee IP safety — only checks covered lists
- Network timeout or service unavailability returns an error response

## How this service works

558 pay-per-call data APIs for AI agents: Solana and EVM on-chain data, tokenized stocks, DeFi, Hyperliquid, economy and official statistics, FX, validation, web and developer tools. Pay in USDC via x402.

## Output

Returns a JSON object with the queried IP, a risk label (e.g. 'no alerts'), a boolean indicating if it's listed on any threat list, a boolean for whether it's a private IP, an array of specific findings, and an array of the reviewed threat lists (abuse.ch Feodo Tracker, Tor exit nodes, Spamhaus DROP), plus an advisory note.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ip": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ip": "8.8.8.8",
  "note": "A clean result does not guarantee the IP is safe; for its network and country use ip-info.",
  "risk": "no alerts",
  "listed": false,
  "private": false,
  "findings": [],
  "reviewed_lists": [
   "abuse.ch Feodo Tracker",
   "Tor exit nodes"
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/vextorium-malicious-ip-checker-b3690447/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.vextorium.com](https://www.zero.xyz/host/api.vextorium.com/llms.txt)