{"uid":"cap_aYnnYqXbyOTfwAiVpayit","slug":"threat-reputation-api-f66f0477","name":"Threat Reputation API","description":"URL/domain/IP threat-reputation lookup: verdict (clean|suspicious|malicious), 0-100 risk score, and the threat-intel signals behind it (URLhaus, AbuseIPDB, Spamhaus ZEN). Paid per call: $0.01 USDC on Base (eip155:8453) via x402 v2 (exact scheme, EIP-3009). Unpaid requests return HTTP 402 with machine-readable payment instructions; the buyer signs the EIP-3009 authorization off-chain and retries with the PAYMENT-SIGNATURE header. The facilitator pays the gas, so the buyer needs no ETH. No API key.","url":"https://threat-reputation-mcp.hsharmanov02.workers.dev/reputation?utm_source=zero.xyz","method":"TOOLS/CALL","headers":{},"bodySchema":null,"responseSchema":{"type":"json","example":{"input":"https://example.com/login","score":0,"signals":{"urlhaus_listed":false,"domain_age_days":11231,"spamhaus_listed":false,"abuseipdb_confidence":null},"verdict":"clean","checked_at":"2026-09-29T10:00:00.000Z"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_d8oMXhdAukHI1T5M7gilv","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Looks up URL, domain, or IP address threat reputation, returning a verdict (clean/suspicious/malicious), 0–100 risk score, and supporting threat-intel signals from URLhaus, AbuseIPDB, and Spamhaus ZEN.","exampleAgentPrompt":"Can you check the threat reputation of https://suspicious-login.example.ru — I need to know if it's clean, suspicious, or malicious, and what the risk score is?","exampleUseCases":[{"title":"Email link safety check","prompt":"Before I click any of these links from this email, can you check each URL's threat reputation and tell me which ones are flagged as malicious or suspicious?"},{"title":"Block-list validation for firewall rules","prompt":"I have this IP address 185.220.101.45 that keeps hitting our server — can you check its AbuseIPDB confidence score and whether it's on Spamhaus ZEN so I can decide whether to block it?"},{"title":"Phishing domain triage for SOC","prompt":"We got a report of a possible phishing domain, promos-secure-update.net — can you look up its threat reputation, check if it's in URLhaus, and tell me how old the domain is?"}],"resultDescription":"Returns a JSON object with the queried input, a verdict string ('clean', 'suspicious', or 'malicious'), an integer risk score from 0 to 100, a set of threat-intel signals (URLhaus listing boolean, domain age in days, Spamhaus ZEN listing boolean, AbuseIPDB confidence score), and an ISO 8601 timestamp of when the check was performed.","failureModes":["HTTP 402 returned if payment is not provided — includes machine-readable payment instructions for x402 v2 (EIP-3009 on Base)","Invalid or malformed URL/IP/domain input may return an error or null signals","AbuseIPDB confidence may be null if the IP has no recorded abuse history","Domain age unavailable for very new or private domains","Rate limits or quota exhaustion if the underlying threat-intel sources are unreachable"],"whenToPreferThis":"Choose this endpoint when you need a fast, pay-per-call threat reputation verdict on a URL, domain, or IP without setting up an API key — ideal for agents that need occasional on-demand threat checks with no subscription commitment. It aggregates multiple threat-intel sources (URLhaus, AbuseIPDB, Spamhaus ZEN) into a single scored response, saving the overhead of querying each source separately. Prefer this over single-source lookups when you want a composite risk score and multi-signal corroboration.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T00:31:53.567Z","isFirstParty":false,"canonicalSlug":"threat-reputation-api-f66f0477"}