{"uid":"cap_gIEYft1kKpxy0h1vcXFpa","slug":"saylor-innovations-data-desk-ip-threat-feed-checker-7e1725b6","name":"Saylor Innovations Data Desk – IP Threat Feed Checker","description":"Check an IP against the Feodo Tracker botnet C2 list, Emerging Threats compromised hosts and the Tor exit list with a combined verdict and matches","url":"https://saylorinnovations.com/api/net/threat-feeds?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ip"],"properties":{"ip":{"type":"string","description":"Public IPv4 or IPv6 address"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string","const":"json"},"example":{"type":"object","required":["ip","verdict","matches"],"properties":{"ip":{"type":"string","description":"IP address"},"note":{"type":"string","description":"Caveat or context for reading the result"},"source":{"type":"string","description":"Data source the values come from"},"matches":{"type":"array","description":"Matching items"},"verdict":{"type":"string","description":"Overall assessment derived from the listed reasons"},"ip_version":{"type":"number","description":"Ip version"},"lists_checked":{"type":"array","description":"Lists checked"},"lists_matched":{"type":"number","description":"Lists matched"}}}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_iSMayZs7Reh7708DmPr4D","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks a single IP address against Feodo Tracker botnet C2, Emerging Threats compromised hosts, and the Tor exit node list, returning a combined verdict and detailed matches","exampleAgentPrompt":"Can you check whether the IP address 185.220.101.45 is flagged on any threat feeds — specifically Feodo Tracker, Emerging Threats compromised hosts, or the Tor exit node list — and give me an overall verdict?","exampleUseCases":[{"title":"Screening inbound connection IP","prompt":"We got a login attempt from 91.108.4.12 — can you check it against the Feodo Tracker botnet C2 list, Emerging Threats, and the Tor exit list and tell me if it's flagged anywhere?"},{"title":"Validating IP before allowing API access","prompt":"Before I whitelist 198.96.155.3 in our firewall, can you run it through the threat feeds and tell me if it matches any botnet C2, compromised host, or Tor exit node entries?"},{"title":"Incident response triage","prompt":"During our investigation we found outbound traffic to 5.34.180.200 — is that IP listed on Feodo Tracker, Emerging Threats compromised hosts, or the Tor exit list? I need the full verdict and which lists matched."}],"resultDescription":"Returns a JSON object with the queried IP, its version (4 or 6), an overall verdict string summarising the risk assessment, an array of matching entries from the checked lists, the count of lists matched, the names of all lists checked, and an optional note providing context or caveats for interpreting the result.","failureModes":["Missing or invalid 'ip' query parameter returns an error","Private or reserved IP ranges may produce empty results or a note caveat","Threat feed data may have a freshness lag, so very recent C2 IPs might not yet appear","IPv6 addresses may have limited coverage depending on feed sources","Network timeout or upstream feed unavailability could cause a 5xx error"],"whenToPreferThis":"Choose this endpoint when you need a quick, multi-feed threat intelligence verdict on a single IP address without setting up your own threat feed subscriptions. It is ideal for lightweight triage — combining Feodo Tracker botnet C2, Emerging Threats compromised hosts, and Tor exit node checks in one call — rather than deep OSINT enrichment. Prefer it over full OSINT platforms when you only need a fast pass/fail signal for network security decisions at low cost.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-18T12:56:33.642Z","isFirstParty":false,"canonicalSlug":"saylor-innovations-data-desk-ip-threat-feed-checker-7e1725b6"}