{"uid":"cap_IINak0NHy1ILEDE8omOBU","slug":"2s-ioc-reputation-check-88611062","name":"2s IOC Reputation Check","description":"Threat-intelligence reputation for an indicator of compromise (IOC) — pass ioc as an IP, domain, URL, or file hash (md5/sha1/sha256) and the type is auto-detected. Returns a malicious boolean plus a per-source breakdown: abuse.ch ThreatFox (IOC→malware/threat mapping), URLhaus (malicious URLs on a host/URL), MalwareBazaar (known malware samples by hash), Feodo Tracker (active botnet C2 IPs), Tor exit-node membership, and Spamhaus DROP (hijacked/criminal netblocks). Each source reports listed + a detail. Sourced from live, hourly-rotating threat feeds an LLM cannot know — a ground-truth liveness check for SOC alert triage, log enrichment, and blocklist decisions. Absence of a match is not proof of safety.","url":"https://2s.io/api/security/ioc-reputation?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","queryParams"],"properties":{"type":{"const":"http"},"method":{"const":"GET"},"queryParams":{"required":["ioc"],"properties":{"ioc":{"type":"string","description":"IP, domain, URL, or file hash."}}}}}}},"responseSchema":null,"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"ioc":"8.8.8.8"}}},"response":{"data":{"ok":true,"items":[{"ioc":"8.8.8.8","hits":0,"note":"No matches in the checked threat-intel sources (absence is not proof of safety).","type":"ip","source":{"url":"https://abuse.ch/","license":"abuse.ch feeds are CC0; Tor list public; Spamhaus DROP free for filtering. Attribution appreciated.","provider":"abuse.ch (ThreatFox/URLhaus/MalwareBazaar) + Feodo Tracker + Tor Project + Spamhaus DROP"},"results":[{"detail":null,"listed":false,"source":"Feodo Tracker (botnet C2)"},{"detail":null,"listed":false,"source":"Tor exit node"},{"detail":null,"listed":false,"source":"Spamhaus DROP"},{"detail":null,"listed":false,"source":"abuse.ch ThreatFox"}],"malicious":false,"sourcesChecked":4}],"total":1,"source":{"url":"https://abuse.ch/","license":"abuse.ch feeds are CC0; Tor list public; Spamhaus DROP free for filtering. Attribution appreciated.","provider":"abuse.ch (ThreatFox/URLhaus/MalwareBazaar) + Feodo Tracker + Tor Project + Spamhaus DROP"}},"meta":{"cost":{"usd":0.00216,"tier":0},"caller":"x402","version":null,"endpoint":"security.ioc-reputation","settlement":{"txHash":"0x747af3f579a0eff4cf668f83ed8ef3f43ed23a0e7180aa0fb11116ff656623fa","network":"eip155:8453","success":true}}}},"exampleRequest":{"ioc":"8.8.8.8"},"tags":["x402"],"displayCostAmount":"0.00216","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.00216/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0054","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0054","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_HZFs8SeQdcrdzAPUy8_Jc","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.0054","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks an IP address, domain, URL, or file hash against multiple threat intelligence feeds (abuse.ch, Feodo Tracker, Tor, Spamhaus) to determine if it is a known malicious indicator of compromise.","exampleAgentPrompt":"Can you check if 139.180.203.104 is a known malicious IP — look it up against threat intelligence feeds and tell me if it's flagged as a botnet C2, spam source, or anything else suspicious?","exampleUseCases":null,"resultDescription":"Returns a JSON object with an array of items, each containing: the IOC string, its type (ip/domain/url/hash), a boolean malicious flag, the number of threat sources checked, total hit count, and a per-source results array showing whether it was listed on each feed (e.g. Feodo Tracker, ThreatFox, Tor exit nodes, Spamhaus DROP) with optional detail strings explaining the threat. Also includes source attribution/license metadata.","failureModes":["Missing or empty 'ioc' query parameter — returns error or 400-level response","Unrecognized IOC format (e.g. malformed IP or hash) — may return empty results or validation error","IOC not found in any feed — returns ok:true with malicious:false and zero hits (not an error, just clean)","Upstream feed unavailability — partial results with reduced sourcesChecked count","Payment failure via x402 — 402 Payment Required if USDC payment not provided"],"whenToPreferThis":"Use this endpoint when you need multi-feed threat intelligence reputation checks against well-known public blocklists (abuse.ch, Feodo Tracker, Spamhaus DROP, Tor) for IPs, domains, URLs, or file hashes. Prefer this over single-source lookups when you want a consolidated malicious verdict with per-source breakdown. Ideal for security triage, automated threat detection pipelines, or SOC workflows where no API keys or account signup is desired and pay-per-call USDC billing is acceptable.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T18:45:21.702Z","isFirstParty":false,"canonicalSlug":"2s-ioc-reputation-check-88611062"}