Security Ioc Reputation

Threat-intelligence reputation for an indicator of compromise (IOC) — pass ioc as an IP, domain, URL, or file hash (md5/sha1/sha256) and the type is auto-detected.

Overview

Threat-intelligence reputation for an indicator of compromise (IOC) — pass ioc as an IP, domain, URL, or file hash (md5/sha1/sha256) and the type is auto-detected. Returns a malicious boolean plus a per-source breakdown: abuse.ch ThreatFox (IOC→malware/threat mapping), URLhaus (malicious URLs on a host/URL), MalwareBazaar (known malware samples by hash), Feodo Tracker (active botnet C2 IPs), Tor exit-node membership, and Spamhaus DROP (hijacked/criminal netblocks). Each source reports listed + a detail. Sourced from live, hourly-rotating threat feeds an LLM cannot know — a ground-truth liveness check for SOC alert triage, log enrichment, and blocklist decisions. Absence of a match is not proof of safety.

Endpoint

Method	Endpoint	Price	Description
GET	/v1/marketplace/api/security-ioc-reputation	$0.002484	Invoke Security Ioc Reputation (Llm) and return the upstream response.

How to call it

Requests are paid per call over the x402 protocol. Call the endpoint, receive a 402 Payment Required quote, then repeat the request with the signed payment header. The SDKs do both steps for you.

# 1. Ask for a quote
curl -i https://api.jarvisclaw.ai/v1/marketplace/api/security-ioc-reputation

# 2. Pay it (the SDK signs and retries for you)
curl -H "X-PAYMENT: <signed-payload>" https://api.jarvisclaw.ai/v1/marketplace/api/security-ioc-reputation

Open in the marketplace