{"uid":"cap_ph3zQwwBNBdgnYaZ6LTTN","slug":"sitecheck-web-intel-ipsum-threat-level-checker-569b9d52","name":"SiteCheck Web Intel – ipsum Threat Level Checker","description":"Checks an IPv4 address against IPsum, an aggregate of public blocklists: returns the number of source feeds that list it (its level, 1 to 8) and whether it is listed at all. A higher level means more feeds agree. Not listed means none of the aggregated feeds list it.","url":"https://api.webintel-api.workers.dev/api/security/ipsum-threat-level?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ip"],"properties":{"ip":{"type":"string","description":"IPv4 address such as 185.220.101.1 (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"ip":"185.220.101.1","level":2,"listed":true,"source":"https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt","entries":126847,"checkedAt":"2026-10-23T09:38:37.620Z"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_p-lrolVUxH9jzwQ2cMR8C","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks an IPv4 address against the ipsum threat intelligence blocklist and returns its threat level score and listing status","exampleAgentPrompt":"Can you check if the IP address 185.220.101.1 is on the ipsum threat intelligence list and tell me its threat level?","exampleUseCases":[{"title":"Block suspicious login attempt","prompt":"Someone just tried to log into our admin panel from 45.155.205.233 — can you check if that IP is on any known threat lists and what its threat level is?"},{"title":"Vet incoming API traffic source","prompt":"We're seeing a lot of requests from 91.92.251.103 hitting our API. Can you look it up on the ipsum blocklist and tell me if it's flagged as a threat?"},{"title":"Security triage for SIEM alert","prompt":"I got an alert about traffic from 194.165.16.78 — can you check the ipsum threat intelligence list to see if that IP is listed and what level of threat it represents?"}],"resultDescription":"Returns a JSON object containing the queried IP address, a numeric threat level (higher = more dangerous), a boolean indicating whether the IP is listed in the ipsum blocklist, the source URL of the blocklist, the total number of entries in the list, and the timestamp when the check was performed.","failureModes":["Missing or invalid 'ip' query parameter returns an error","Non-IPv4 addresses (e.g. IPv6, hostnames) may not be supported","Payment failure results in no charge and no data returned","Blocklist source temporarily unavailable may cause stale or failed responses"],"whenToPreferThis":"Choose this endpoint when you need a quick, pay-per-call IP reputation check against the community-curated ipsum blocklist without requiring API keys or subscriptions. It is particularly useful for lightweight threat triage, SIEM enrichment, or ad-hoc checks on suspicious IPs. For broader multi-source IP reputation (e.g. CI Army / CINS Score), use the sibling CINS Score endpoint instead.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-25T12:31:25.767Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-ipsum-threat-level-checker-569b9d52"}