{"uid":"cap_bSspb98yAvZPdxh59DH21","slug":"orioncmd-bulk-threat-check-dac81e37","name":"OrionCMD Bulk Threat Check","description":"OrionCMD Checks: Bulk IOC check: up to 100 domains or IPv4 (domains resolved, IPs matched too). Up to 100 comma- or newline-separated domains, URLs or IPv4 addresses in ?q=. Each domain is resolved (A) and the name, parent domains and resolved IPv4 are matched against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed hourly). No ransomware-claim lookups (use /v1/threat-check). Stale feed answers 503 before payment.","url":"https://api.orioncmd.com/v1/bulk-threat-check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["q"],"properties":{"q":{"type":"string","description":"Up to 100 domains/IPv4, comma separated"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"report":"bulk_threat_check","results":[{"item":"example.com","type":"domain","listed":false,"matches":[],"resolved_ipv4":["93.184.215.14"]}],"item_count":2,"listed_count":0}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.5","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.5/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.5","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.5","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_ESLAMA1Adrcx2spBY9Ydt","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.5","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Check up to 100 domains or IPv4 addresses in bulk against threat intelligence databases for malicious listings and security risks","exampleAgentPrompt":"Can you run a bulk threat check on these domains and IPs — example.com, 192.168.1.1, malware-site.net — and tell me which ones are flagged as threats or associated with ransomware?","exampleUseCases":[{"title":"Vendor domain security vetting","prompt":"I have a list of 50 vendor domains we're about to onboard — can you check all of them for threat intelligence flags, ransomware associations, or any malicious listings before we proceed?"},{"title":"SOC alert triage for suspicious IPs","prompt":"We've got these 20 IP addresses showing up in our firewall logs: 198.51.100.1, 203.0.113.45, 192.0.2.10 — can you run them through a threat intelligence check and tell me which ones are known bad actors?"},{"title":"Pre-launch domain blocklist scan","prompt":"Before we go live, can you scan these domains against threat intelligence feeds — shop.mycompany.com, api.mycompany.com, cdn.mycompany.com — and confirm none of them are blacklisted or flagged for ransomware?"}],"resultDescription":"A JSON report labeled 'bulk_threat_check' containing per-item results with: the queried item (domain or IP), its classified type, whether it is listed in threat intelligence feeds, any threat matches found, and resolved IPv4 addresses. Also includes aggregate counts for total items checked and how many are listed as threats.","failureModes":["Missing or empty 'q' query parameter returns an error","More than 100 items submitted exceeds the bulk limit","Malformed domain or IP format may cause parsing errors or be skipped","Network timeouts if DNS resolution for queried items fails","Payment failure via x402 protocol blocks the request"],"whenToPreferThis":"Choose this endpoint when you need to check multiple domains or IPs (up to 100) in a single call against threat intelligence data including ransomware claims and evidence-backed security reports. Prefer it over single-item checks for batch workflows, and over generic WHOIS or DNS tools when threat listing status and ransomware intelligence are the primary concern.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-18T12:30:13.144Z","isFirstParty":false,"canonicalSlug":"orioncmd-bulk-threat-check-dac81e37"}