{"uid":"cap_eFx4qAytQmzALdEVR6u2N","slug":"netintel-production-440c-up-railway-app-6ca3d5b0","name":"NetIntel IP Reputation Analyzer","description":"Check an IP address against AbuseIPDB and AlienVault OTX threat feeds. Returns a composite risk score, threat categories, malware families, and full source data.","url":"https://netintel-production-440c.up.railway.app/ip-reputation/analyze?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ip"],"properties":{"ip":{"type":"string","description":"IPv4 or IPv6 address to check"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"ip":{"type":"string"},"otx":{"type":"object"},"abuseipdb":{"type":"object"},"composite":{"type":"object"},"risk_level":{"type":"string"},"risk_score":{"type":"number","description":"0-100, higher = more malicious"}}}}}}},"responseSchema":{"type":"json","example":{"ip":"185.220.101.45","otx":{"asn":"AS53667","available":true,"reputation":-100,"pulse_count":38,"country_code":"NL","threat_types":["scanning"],"malware_families":["Mirai"]},"abuseipdb":{"isp":"Frantech Solutions","domain":"frantech.ca","categories":[18,14],"usage_type":"Data Center/Web Hosting/Transit","total_reports":1842,"confidence_score":100,"last_reported_at":"2024-11-01T14:22:00Z","distinct_reporters":312},"composite":{"last_seen":"2024-11-01T14:22:00Z","first_seen":"2022-03-11","is_malicious":true,"threat_categories":["brute_force","port_scan"]},"risk_level":"critical","risk_score":87}},"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"ip":"8.8.8.8"}}},"response":{"ip":"8.8.8.8","otx":{"asn":"AS15169 google llc","reputation":0,"pulse_count":0,"country_code":"US","threat_types":[],"malware_families":[]},"abuseipdb":{"isp":"Google LLC","domain":"google.com","categories":[14,18,22,15,21,20,19,10,1,4,9,13,3,7,11,16],"usage_type":"Content Delivery Network","total_reports":130,"confidence_score":0,"last_reported_at":"2026-06-13T03:53:18+00:00","distinct_reporters":74},"composite":{"last_seen":"2026-06-13T03:53:18+00:00","first_seen":"2026-06-13T03:53:18+00:00","is_malicious":false,"threat_categories":["port_scan","brute_force","ssh_brute_force","hacking","web_attack","exploited_host","bad_web_bot","web_spam","ddos_attack","open_proxy","vpn_ip","fraud_orders","phishing","email_spam","sql_injection"]},"risk_level":"none","risk_score":0}},"exampleRequest":{"ip":"8.8.8.8"},"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":1,"rating":{"score":"0.83","successRate":"1.00","reviews":1,"stars":"4.3","state":"rated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_RZWB8cCALH-K9b4GfDonW","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks an IP address against AbuseIPDB and AlienVault OTX threat feeds, returning a composite risk score, threat categories, malware families, and full source data.","exampleAgentPrompt":"Can you check whether 185.220.101.45 is a known malicious IP — pull its composite risk score and any threat categories from AbuseIPDB and AlienVault OTX?","exampleUseCases":[{"title":"Automated incident triage for suspicious traffic","prompt":"We just blocked some incoming traffic from 203.0.113.42 — can you quickly check that IP against both AbuseIPDB and AlienVault OTX to see if it's actually malicious and what threat categories it's associated with?"},{"title":"Security audit of compromised server logs","prompt":"I'm reviewing access logs from our honeypot and seeing requests from several IPs. Can you batch-check 192.0.2.8, 198.51.100.15, and 203.0.113.99 — I need their composite risk scores and any malware families flagged in the threat feeds?"},{"title":"Validate third-party vendor network connections","prompt":"Before we whitelist this vendor's IP range, I need to verify that 198.18.0.1 isn't showing up in abuse or malware feeds. Give me the full risk assessment and any reported threat categories so I can decide if it's safe."}],"resultDescription":"Returns a JSON object containing the queried IP, a numeric composite risk score, a risk level label (e.g. low/medium/high), threat categories, malware families, and the full raw response objects from both AbuseIPDB and AlienVault OTX.","failureModes":["Invalid or malformed IP address returns a 400 error","Private/reserved IP addresses may return no threat data","Payment failure (402) if USDC balance is insufficient","Upstream AbuseIPDB or OTX API outage may cause degraded or missing source data","Rate limiting or network timeout on the Railway deployment"],"whenToPreferThis":"Use this endpoint when you need a multi-source IP reputation check that combines AbuseIPDB abuse reports and AlienVault OTX threat intelligence into a single composite score. Prefer it over single-source lookups when you need both abuse history and malware/threat-category context in one call, especially in automated security workflows or incident triage pipelines.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":1,"lastUsedAt":"2026-06-12T15:28:25.632Z","lastSuccessfullyRanAt":"2026-06-12T15:28:25.632Z","lastHealthCheckAt":"2026-10-11T12:47:23.545Z","isFirstParty":false,"canonicalSlug":"netintel-production-440c-up-railway-app-6ca3d5b0"}