# Zero-Day Dynamics Host Threat Intelligence

> Zero-Day Dynamics Host Threat Intelligence is a paid API for AI agents from zero-daydynamics.com, paid per call via x402, $0.25/call, status unknown (last checked 2026-10-22).

Performs a comprehensive threat assessment of a host — scanning open ports, known CVEs, exploit probability, ransomware risk flags, ASN details, and geolocation.

## Facts

- Endpoint: POST https://zero-daydynamics.com/api/x402/threat-intel?utm_source=zero.xyz
- Price: $0.25/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-22
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/zero-day-dynamics-host-threat-intelligence-8ab16118
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Ik9EwF7eUzxpCj2NC7vDc

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability zero-day-dynamics-host-threat-intelligence-8ab16118 -d '<json body>'
```

Example prompt: Run a full threat assessment on the host 185.220.101.45 — I need to know its open ports, any associated CVEs, the exploit probability, whether it's been flagged for ransomware, and its ASN and geolocation.

## When to prefer this

Choose this endpoint when you need a consolidated, multi-signal threat assessment of a specific host or IP — combining port exposure, CVE mapping, exploit probability, and ransomware flags in a single call. Prefer it over generic WHOIS or DNS lookups when the primary concern is active threat or vulnerability exposure, and over raw Shodan/Censys when you want pre-scored exploit and ransomware risk signals rather than raw scan data.

## Known failure modes

- Invalid or unresolvable hostname/IP returns an error
- Private/RFC1918 IP addresses may return limited or no data
- Rate limiting may apply for high-frequency submissions
- Hosts with no scan history may return sparse CVE or port data
- Payment failure via x402 results in 402 response and no data returned

## How this service works

Host threat assessment (ports, CVEs, exploit probability, ransomware flags, ASN, geo).

## Output

Returns a structured threat profile for the submitted host including: list of open ports, associated CVEs with severity details, a calculated exploit probability score, ransomware campaign association flags, ASN and network ownership info, and geolocation data (country, city, coordinates).

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/zero-day-dynamics-host-threat-intelligence-8ab16118/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from zero-daydynamics.com](https://www.zero.xyz/host/zero-daydynamics.com/llms.txt)