{"uid":"cap_paGi18iJHfeaQpzyK-rBA","slug":"netintel-ip-reputation-analyzer-46ba1356","name":"NetIntel IP Reputation Analyzer","description":"Check an IP address against AbuseIPDB and AlienVault OTX threat feeds. Returns a composite risk score, threat categories, malware families, and full source data.","url":"https://netintel.dev/ip-reputation/analyze","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ip"],"properties":{"ip":{"type":"string","description":"IPv4 or IPv6 address to check"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"ip":{"type":"string"},"otx":{"type":"object"},"abuseipdb":{"type":"object"},"composite":{"type":"object"},"risk_level":{"type":"string"},"risk_score":{"type":"number","description":"0-100, higher = more malicious"}}}}}}},"responseSchema":{"type":"json","example":{"ip":"185.220.101.45","otx":{"asn":"AS53667","available":true,"reputation":-100,"pulse_count":38,"country_code":"NL","threat_types":["scanning"],"malware_families":["Mirai"]},"abuseipdb":{"isp":"Frantech Solutions","domain":"frantech.ca","categories":[18,14],"usage_type":"Data Center/Web Hosting/Transit","total_reports":1842,"confidence_score":100,"last_reported_at":"2024-11-01T14:22:00Z","distinct_reporters":312},"composite":{"last_seen":"2024-11-01T14:22:00Z","first_seen":"2022-03-11","is_malicious":true,"threat_categories":["brute_force","port_scan"]},"risk_level":"critical","risk_score":87}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_grQhw8iXfdd1LQMoeYLq_","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes an IPv4 or IPv6 address for reputation, threat intelligence, and risk scoring by aggregating data from OTX and AbuseIPDB sources","exampleAgentPrompt":"Can you check the reputation of IP address 185.220.101.45 and tell me if it's malicious, what its risk score is, and what kinds of threats it's associated with?","exampleUseCases":null,"resultDescription":"Returns a JSON object containing the queried IP address, OTX threat intelligence data (ASN, reputation score, pulse count, country, threat types, malware families), AbuseIPDB data (ISP, domain, usage type, total reports, confidence score, distinct reporters, last reported date), a composite summary (first/last seen, is_malicious flag, threat categories), a numeric risk_score (0-100), and a risk_level string (e.g. 'critical', 'high', 'medium', 'low').","failureModes":["Invalid IP address format returns a 400 error","Payment not provided or insufficient USDC balance returns a 402 Payment Required","IP address not found in any threat intelligence source returns low/zero scores with empty arrays","Rate limiting or upstream OTX/AbuseIPDB API unavailability may cause 503 or delayed responses","IPv6 addresses may have less coverage than IPv4 in upstream databases"],"whenToPreferThis":"Choose this endpoint when you need a comprehensive, aggregated IP threat assessment combining both OTX and AbuseIPDB signals in a single call, especially when you want a composite risk score and risk level alongside raw source data. Preferred over querying OTX or AbuseIPDB separately when cost efficiency and unified output matter. Well-suited for security automation, firewall rule decisions, or incident response triage.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T00:48:04.848Z","isFirstParty":false}