{"uid":"cap_YH0GLSV8JmwOTDqxV7Z59","slug":"orioncmd-threat-check-608f5c82","name":"OrionCMD Threat Check","description":"OrionCMD Checks: Domain threat check: IOC feed match (name + resolved IPs) and ransomware leak-site claims. Resolves the hostname (A/AAAA via Cloudflare DoH), matches the hostname, its parent domains and resolved IPv4 addresses against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed hourly), and looks up ransomware leak-site claims naming the domain from commercially reusable sources (via Dragons Eye). Returns one verdict: listed, claimed, listed_and_claimed or no_known_threat","url":"https://api.orioncmd.com/v1/threat-check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","description":"Hostname or URL, e.g. example.com"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"dns":{"a":["93.184.215.14"],"aaaa":[]},"ioc":{"feed":{"confidence":"high","refreshed_at":"2026-10-17T06:07:00.000Z","window_hours":720,"indicators_in_feed":831},"listed":false,"matches":[]},"host":"example.com","summary":["Not in ThreatCluster's high-confidence 30-day IOC feed (hostname, parent domains, resolved IPv4).","No ransomware leak-site claim found for example.com in commercially reusable sources."],"verdict":"no_known_threat","ransomware_claims":{"found":false,"label":"unverified claim from a criminal leak site","claims":[],"claim_count":0}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_cZHGIHjY3l2uGhQ8zQuJa","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks a domain for uptime, SSL, DNS, IOC feed presence, and ransomware leak-site claims, returning a threat verdict.","exampleAgentPrompt":"Run a threat check on suspicious-vendor.com — I want to know if it shows up in any high-confidence IOC feeds or has been claimed by a ransomware group.","exampleUseCases":[{"title":"Vetting a third-party vendor domain","prompt":"Before we onboard this supplier, can you check whether their domain fastlogistics-partner.com is flagged in any threat intelligence feeds or has been hit by ransomware?"},{"title":"Security review before employee access","prompt":"Our team is about to start using the portal at clientportal-acme.io — can you run a threat and IOC check on that domain to make sure it's clean before we roll it out?"},{"title":"Automated alert triage for SOC","prompt":"We just got an alert mentioning the domain trk.suspiciouslinks.net — can you look it up in threat feeds and ransomware leak sites to help me decide if this is a real incident?"}],"resultDescription":"Returns a JSON object containing the threat verdict (e.g. 'no_known_threat'), resolved DNS A and AAAA records, IOC feed metadata (confidence, freshness, match list), ransomware claim details (found flag, claim count, claim list), and a human-readable summary array explaining the findings.","failureModes":["Missing 'domain' query parameter returns an error","Invalid or malformed hostname may return empty DNS records and inconclusive verdict","Domain not yet indexed in threat feeds returns 'no_known_threat' but does not confirm safety","IOC feed may not reflect real-time threats if refreshed_at timestamp is stale","Network timeout if the upstream threat feed or DNS resolution is slow"],"whenToPreferThis":"Choose this endpoint when you need a quick, per-domain threat intelligence verdict that combines IOC feed matching, ransomware leak-site claims, and DNS resolution in a single call. Prefer it over generic WHOIS or ping tools when you specifically need structured threat context (confidence scores, feed freshness, ransomware claim evidence) at a low per-call cost of $0.02 USDC.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-18T12:39:41.910Z","isFirstParty":false,"canonicalSlug":"orioncmd-threat-check-608f5c82"}