{"uid":"cap_jfCYB4AklHdeTxg_dsIP0","slug":"sitecheck-web-intel-ssl-blacklist-certificate-lookup-82db2e94","name":"SiteCheck Web Intel – SSL Blacklist Certificate Lookup","description":"Checks a certificate SHA-1 fingerprint (40 hex characters) against the abuse.ch SSL Blacklist of certificates seen on malware botnet C2 servers. A hit returns the date added and the malware reason from the list. Only certificates this list tracks are covered.","url":"https://api.webintel-api.workers.dev/api/security/sslbl-abuse-certs?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["sha1"],"properties":{"sha1":{"type":"string","description":"Certificate SHA-1 fingerprint, 40 hex characters (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"sha1":"38151a6b2438b2b645a27a891e1e15786f11a783","entry":{"added":"2026-10-18 12:25:30","reason":"PureLogsStealer C&C"},"listed":true,"source":"https://sslbl.abuse.ch/blacklist/sslblacklist.csv","listSize":11032,"checkedAt":"2026-10-23T09:38:37.077Z"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_xkDW6EzY-mlc7dqbrSHmm","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks a certificate SHA-1 fingerprint against the abuse.ch SSL Blacklist to determine if it has been linked to malware botnet C2 servers","exampleAgentPrompt":"Check if the certificate with SHA-1 fingerprint 38151a6b2438b2b645a27a891e1e15786f11a783 is on the abuse.ch SSL blacklist — I want to know if it's been flagged for malware or C2 activity and when it was added.","exampleUseCases":[{"title":"Malware C2 certificate vetting","prompt":"I intercepted TLS traffic and got the certificate fingerprint 38151a6b2438b2b645a27a891e1e15786f11a783 — can you check if it's listed on the abuse.ch SSL blacklist and tell me what malware family it's tied to?"},{"title":"Automated threat intel enrichment","prompt":"During our incident response, we found a suspicious certificate with SHA-1 hash 4a1b2c3d4e5f6789abcdef0123456789abcdef01 — look it up on the SSLBL abuse.ch blacklist and tell me if it's been flagged and for what reason."},{"title":"Network security monitoring alert triage","prompt":"Our firewall flagged a connection using a cert with fingerprint 1234567890abcdef1234567890abcdef12345678 — check the abuse.ch SSL blacklist to see if this certificate is associated with any known botnet or malware campaign."}],"resultDescription":"Returns a JSON object indicating whether the certificate is listed (true/false), the date it was added to the blacklist, the associated malware/reason string (e.g. 'PureLogsStealer C&C'), the source URL of the blacklist, the total number of entries in the list, and the timestamp when the check was performed.","failureModes":["Certificate not found in list returns listed:false with no entry details — does not indicate the certificate is safe, only that it is not on this specific list","Invalid SHA-1 fingerprint format (not 40 hex characters) may return an error or no results","List coverage is limited to certificates tracked by abuse.ch SSLBL — many malicious certificates may not be included","Stale list data if the upstream abuse.ch list has not been recently synced","Network timeout or upstream API unavailability from abuse.ch infrastructure"],"whenToPreferThis":"Use this endpoint when you have a specific TLS/SSL certificate SHA-1 fingerprint and need to quickly check it against the abuse.ch SSL Blacklist, a well-known threat intelligence feed focused on malware botnet command-and-control certificates. Prefer this over generic certificate validation tools when the goal is threat intelligence lookup rather than certificate validity checking. Best suited for security operations, incident response, or automated threat enrichment pipelines where checking certificate reputation against a curated malware C2 list is needed.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-24T12:33:00.175Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-ssl-blacklist-certificate-lookup-82db2e94"}