Threat intelligence API that extracts indicators of compromise, C2 infrastructure, threat actor profiles, breach disclosures and CVE signals from public Telegram security channels, returned as structured JSON with MITRE ATT&CK tags and confidence scores.
Pay from $0.01 to $0.05 per request in USDC on Base, settled onchain via the x402 protocol, no signup, no API key needed.
UPTIME 24H 100% │ 7D 100% │ 30D 100%
ASSESSMENT
updated 5h agoEvidence-backed signals, not a single score. Click any chip for the proof. Measured values stay read-only; unknown is honest.
reliability 100%
- uptime 24h
- 100%
- uptime 7d
- 100%
- uptime 30d
- 100%
- uptime 90d
- 100%
- response p95
- 212ms
- avg response
- 165ms
- total checks
- 47
compliance A (11/11)
11 of 11 x402 conformance checks pass. Full checklist below.
price $0.01 to $0.05 (p62 in Data)
- price (min)
- $0.01
- price (max)
- $0.05
- category percentile (min)
- p62 in Data
- category percentile (max)
- p69 in Data
- endpoints / prices
- 10 / 4
- model
- tiered
- stability
- 100%
risk clean
No deterministic risk flag. Risk fires only on an exact blocklist match, or a reserved-brand name with a mismatched verified payTo. Never from low uptime, a high price, or a model guess.
traction $13.06 30d · 12 buyers
- volume 30d
- $13.06
- buyers 30d
- 12
- settlements 30d
- 214
- last settlement
- 2026-07-21
- top buyer share
- 28% of 30d volume
- trend 7d vs 30d
- 0.21x the 30d daily rate
- networks
- eip155:8453
Conservative undercount: only USDC settlements via facilitators we measure are counted. A measured floor, not an estimate.
Top buyer share is a concentration signal, not part of the ranking score.
WHAT IT DOES
ai-derivedProvides real-time cyber threat intelligence from public Telegram channels through various endpoints for threat indicators and analysis.
- category
- threat-intelligence
- in
- query params
- auth
- api key
AI-generated summary. The measured data is never altered by it.
ENDPOINTS
| METHOD | PATH | DESCRIPTION | PRICE | NETWORK | ASSET |
|---|---|---|---|---|---|
| GET | /artifact | $0.05 | Base | USDC | |
| GET | /breach | $0.03 | Base | USDC | |
| GET | /c2 | $0.02 | Base | USDC | |
| GET | /darkweb | $0.03 | Base | USDC | |
| GET | /feed | $0.05 | Base | USDC | |
| GET | /intent | $0.05 | Base | USDC | |
| GET | /ioc | $0.01 | Base | USDC | |
| GET | /malware | $0.02 | Base | USDC | |
| GET | /source | $0.02 | Base | USDC | |
| GET | /vulnerability | $0.03 | Base | USDC |
10 endpoints
REQUEST / RESPONSE EXAMPLE
An unpaid request to GET /artifact returns HTTP 402 with the payment terms. Settle onchain via your facilitator, then retry with the X-Payment header.
// request
curl -i 'https://telesint-api.onrender.com/artifact'
// 402 response (captured by monitor) · 10 payloads · click to expand
[
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "30000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/vulnerability",
"mimeType": "application/json",
"description": "CVE and exploitation-in-the-wild signals from Telegram CTI channels. Filters: severity, min_confidence, since, tag(cve|exploit|poc|patch), ttp, type(cve), limit, offset. Returns CVE IDs, affected products, exploit status."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"tag": "cve",
"type": "cve",
"limit": 20,
"since": "2026-05-01T00:00:00Z",
"offset": 0,
"severity": "high",
"min_confidence": 60
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "v1u2l3n4-5678-90ab-cdef-vuln56789012",
"ts": "2026-05-27T10:00:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "cve",
"value": "CVE-2026-1234",
"context": "Critical RCE in PAN-OS"
},
{
"type": "url",
"value": "https://github[.]com/exploit-db/CVE-2026-1234",
"context": "PoC repository"
}
],
"tags": [
"cve",
"rce",
"palo-alto",
"pan-os",
"poc",
"exploit-in-the-wild"
],
"ttps": [
{
"id": "T1190",
"name": "Exploit Public-Facing Application",
"tactic": "Initial Access"
},
{
"id": "T1203",
"name": "Exploitation for Client Execution",
"tactic": "Execution"
}
],
"channel": "https://t[.]me/vxunderground",
"summary": "PoC released for CVE-2026-1234 (CVSS 9.8): unauthenticated RCE in Palo Alto PAN-OS. Exploitation observed in the wild targeting government networks.",
"category": "vulnerability",
"severity": "critical",
"confidence": 91
}
],
"limit": 20,
"total": 34,
"offset": 0,
"source": "TeleSint",
"endpoint": "vulnerability"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"description": "Tag keyword filter, e.g. cve, exploit, poc, patch, zero-day"
},
"ttp": {
"type": "string",
"description": "MITRE ATT&CK technique ID prefix, e.g. T1190, T1203"
},
"type": {
"type": "string",
"description": "IOC type filter: cve"
},
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"since": {
"type": "string",
"description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"severity": {
"type": "string",
"description": "Minimum severity: critical | high | medium | low | info"
},
"min_confidence": {
"type": "number",
"description": "Minimum AI confidence score 0-100"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "50000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/artifact",
"mimeType": "application/json",
"description": "CTI artifact export from a TeleSint record. Required: id (record UUID), format (sigma|stix|report). Returns Sigma rule, STIX 2.1 bundle, or structured analyst report built from real enriched intel."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
"format": "sigma"
}
},
"output": {
"type": "json",
"example": {
"format": "stix",
"source": "TeleSint",
"artifact": {
"id": "bundle--f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
"type": "bundle",
"objects": [
{
"id": "indicator--f8a3c1d2-ip-0",
"name": "IP: 91.92.109.83",
"type": "indicator",
"labels": [
"malicious-activity"
],
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.92.109.83']",
"confidence": 90,
"valid_from": "2026-05-27T09:15:00Z",
"pattern_type": "stix",
"spec_version": "2.1"
},
{
"id": "attack-pattern--f8a3c1d2-T1071-001",
"name": "Application Layer Protocol: Web Protocols",
"type": "attack-pattern",
"spec_version": "2.1",
"external_references": [
{
"external_id": "T1071.001",
"source_name": "mitre-attack"
}
]
},
{
"id": "report--f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
"name": "Cobalt Strike beacon with malleable C2 profile mimicking Microsoft update traffic",
"type": "report",
"labels": [
"c2",
"cobalt-strike",
"malleable-c2"
],
"confidence": 90,
"spec_version": "2.1"
}
],
"spec_version": "2.1"
},
"category": "c2",
"endpoint": "artifact",
"record_id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
"generated_at": "2026-06-01T12:00:00Z"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"id",
"format"
],
"properties": {
"id": {
"type": "string",
"description": "Intel record UUID from any TeleSint endpoint response (items[].id)"
},
"format": {
"type": "string",
"description": "Artifact format: sigma (detection rule) | stix (STIX 2.1 bundle) | report (analyst report)"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "10000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/ioc",
"mimeType": "application/json",
"description": "IOC feed from Telegram CTI channels. Filters: type(ip|domain|url|hash|cve), severity, min_confidence, since, tlp, tag, channel, limit, offset. Returns items[] with iocs[], ttps[], confidence, severity, tlp, tags[]."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"tag": "ransomware",
"tlp": "WHITE",
"type": "ip",
"limit": 20,
"since": "2026-05-01T00:00:00Z",
"offset": 0,
"channel": "vxunderground",
"severity": "high",
"min_confidence": 70
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
"ts": "2026-05-27T14:32:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "url",
"value": "https://github[.]com/Nightmare-Eclipse/MiniPlasma",
"context": "Exploit repository"
},
{
"type": "ip",
"value": "185.220[.]101.47",
"context": "C2 callback address"
},
{
"type": "sha256",
"value": "e3b0c44298fc1c149afb4c8996fb924...",
"context": "Dropper hash"
}
],
"tags": [
"zero-day",
"windows",
"government",
"exploit"
],
"ttps": [
{
"id": "T1204.002",
"name": "User Execution: Malicious File",
"tactic": "Execution"
},
{
"id": "T1071.001",
"name": "Application Layer Protocol: Web Protocols",
"tactic": "Command and Control"
}
],
"channel": "https://t[.]me/vxunderground",
"summary": "Windows zero-day exploit released by Nightmare Eclipse threat group targeting government networks",
"category": "ioc",
"severity": "high",
"confidence": 80
}
],
"limit": 20,
"total": 42,
"offset": 0,
"source": "TeleSint",
"endpoint": "ioc"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"description": "Tag keyword filter, e.g. ransomware, cobalt-strike, apt"
},
"tlp": {
"type": "string",
"description": "TLP classification: WHITE | GREEN | AMBER | RED"
},
"type": {
"type": "string",
"description": "IOC type: ip | domain | url | md5 | sha1 | sha256 | cve"
},
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"since": {
"type": "string",
"description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"channel": {
"type": "string",
"description": "Partial match on source Telegram channel name"
},
"severity": {
"type": "string",
"description": "Minimum severity: critical | high | medium | low | info"
},
"min_confidence": {
"type": "number",
"description": "Minimum AI confidence score 0-100"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "30000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/darkweb",
"mimeType": "application/json",
"description": "Dark web intelligence from Telegram: marketplace listings, forum chatter, access broker posts, credential shops, Tor site activity. Filters: severity, min_confidence, since, tag, sector, country, organization, limit, offset."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"tag": "access-broker",
"limit": 20,
"since": "2026-05-01T00:00:00Z",
"offset": 0,
"sector": "finance",
"severity": "high",
"min_confidence": 60
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "d1a2r3k4-w5e6-7890-abcd-darkweb78901",
"ts": "2026-05-27T06:45:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "url",
"value": "https://exploit[.]in/threads/healthcare-access-12345",
"context": "Underground forum listing"
}
],
"tags": [
"access-broker",
"healthcare",
"initial-access",
"domain-admin",
"exploit-in"
],
"ttps": [
{
"id": "T1078",
"name": "Valid Accounts",
"tactic": "Initial Access"
}
],
"target": {
"sectors": [
"healthcare"
],
"countries": [
"US"
],
"organizations": []
},
"channel": "https://t[.]me/darkwebinformer",
"summary": "Access broker selling domain admin access to US healthcare network (5,000 employees) — asking $15,000 on exploit.in forum",
"category": "darkweb",
"severity": "critical",
"confidence": 78
}
],
"limit": 20,
"total": 14,
"offset": 0,
"source": "TeleSint",
"endpoint": "darkweb"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"description": "Tag keyword: access-broker | credential-shop | combo-list | carding | forum | marketplace"
},
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"since": {
"type": "string",
"description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"sector": {
"type": "string",
"description": "Targeted sector: finance | healthcare | government | energy | retail"
},
"country": {
"type": "string",
"description": "Targeted country keyword, e.g. us | uk | de | fr"
},
"severity": {
"type": "string",
"description": "Minimum severity: critical | high | medium | low | info"
},
"organization": {
"type": "string",
"description": "Targeted organization name partial match"
},
"min_confidence": {
"type": "number",
"description": "Minimum AI confidence score 0-100"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "20000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/malware",
"mimeType": "application/json",
"description": "Malware family intelligence from Telegram: new sample drops, behavior analysis, loader/stealer/RAT/backdoor writeups. Filters: severity, min_confidence, since, tag(stealer|loader|rat|backdoor), limit, offset."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"tag": "stealer",
"limit": 20,
"since": "2026-05-01T00:00:00Z",
"offset": 0,
"severity": "high",
"min_confidence": 60
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "m1a2l3w4-a5r6-7890-abcd-malware78901",
"ts": "2026-05-27T11:00:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "sha256",
"value": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
"context": "Lumma Stealer sample"
},
{
"type": "domain",
"value": "lumma-panel[.]xyz",
"context": "C2 panel domain"
}
],
"tags": [
"lumma",
"stealer",
"maas",
"infostealer",
"chrome"
],
"ttps": [
{
"id": "T1555.003",
"name": "Credentials from Web Browsers",
"tactic": "Credential Access"
},
{
"id": "T1071.001",
"name": "Application Layer Protocol: Web Protocols",
"tactic": "Command and Control"
}
],
"channel": "https://t[.]me/vxunderground",
"summary": "New Lumma Stealer v4.1 released with browser cookie bypass targeting Chrome 124+ — sold as MaaS on underground forums",
"category": "malware",
"severity": "high",
"confidence": 85
}
],
"limit": 20,
"total": 19,
"offset": 0,
"source": "TeleSint",
"endpoint": "malware"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"description": "Malware type tag: stealer | loader | rat | backdoor | botnet | worm | dropper | rootkit"
},
"ttp": {
"type": "string",
"description": "MITRE ATT&CK technique ID prefix, e.g. T1059, T1071"
},
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"since": {
"type": "string",
"description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"severity": {
"type": "string",
"description": "Minimum severity: critical | high | medium | low | info"
},
"min_confidence": {
"type": "number",
"description": "Minimum AI confidence score 0-100"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "50000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/intent",
"mimeType": "application/json",
"description": "Pre-attack intent signals from Telegram: access sales, 0days, ransomware targeting. Filters: sector, country, organization, intent_type(access_sale|0day|ransomware|exploit), limit. Signals appear before attacks."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"limit": 20,
"offset": 0,
"sector": "healthcare",
"country": "us",
"intent_type": "ransomware",
"organization": "hospital"
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "i1n2t3e4-n5t6-7890-abcd-intent789012",
"ts": "2026-05-27T07:22:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "url",
"value": "https://exploit[.]in/threads/healthcare-access",
"context": "Access sale listing"
}
],
"tags": [
"access-sale",
"healthcare",
"vpn",
"initial-access-broker"
],
"ttps": [
{
"id": "T1078",
"name": "Valid Accounts",
"tactic": "Initial Access"
},
{
"id": "T1110",
"name": "Brute Force",
"tactic": "Credential Access"
}
],
"target": {
"sectors": [
"healthcare"
],
"countries": [
"US"
],
"organizations": []
},
"channel": "https://t[.]me/ctifeeds",
"summary": "Threat actor selling VPN access to US healthcare network: 5,000 employee credentials, domain admin included",
"category": "intent",
"severity": "critical",
"confidence": 72
}
],
"limit": 20,
"total": 3,
"offset": 0,
"source": "TeleSint",
"endpoint": "intent"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"sector": {
"type": "string",
"description": "Targeted sector: finance | healthcare | government | energy | retail"
},
"country": {
"type": "string",
"description": "Targeted country keyword, e.g. us | uk | de | fr"
},
"intent_type": {
"type": "string",
"description": "Signal type: access_sale | 0day | ransomware | exploit | recruitment"
},
"organization": {
"type": "string",
"description": "Targeted organization name partial match"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "30000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/breach",
"mimeType": "application/json",
"description": "Breach disclosures from Telegram. Filters: sector, country, organization, severity, min_confidence, since, limit. Returns items[] with target{sectors,countries,organizations}, leak iocs[], confidence."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"limit": 20,
"since": "2026-05-01T00:00:00Z",
"offset": 0,
"sector": "finance",
"country": "us",
"severity": "high",
"organization": "acme",
"min_confidence": 60
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "b1r2e3a4-c5h6-7890-abcd-123456789012",
"ts": "2026-05-27T11:45:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "url",
"value": "https://lockbit3[.]onion/leak/usbank-data",
"context": "Ransomware leak site"
}
],
"tags": [
"lockbit",
"ransomware",
"finance",
"data-leak",
"pii"
],
"ttps": [
{
"id": "T1486",
"name": "Data Encrypted for Impact",
"tactic": "Impact"
},
{
"id": "T1041",
"name": "Exfiltration Over C2 Channel",
"tactic": "Exfiltration"
}
],
"target": {
"sectors": [
"finance"
],
"countries": [
"US"
],
"organizations": [
"Regional Bank Corp"
]
},
"channel": "https://t[.]me/cyberinsider",
"summary": "LockBit claims breach of US regional bank: 2.4M customer records including SSNs and account numbers",
"category": "breach",
"severity": "critical",
"confidence": 75
}
],
"limit": 20,
"total": 17,
"offset": 0,
"source": "TeleSint",
"endpoint": "breach"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"since": {
"type": "string",
"description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"sector": {
"type": "string",
"description": "Targeted sector: finance | healthcare | government | energy | retail"
},
"country": {
"type": "string",
"description": "Targeted country keyword, e.g. us | uk | de | fr"
},
"severity": {
"type": "string",
"description": "Minimum severity: critical | high | medium | low | info"
},
"organization": {
"type": "string",
"description": "Targeted organization name partial match"
},
"min_confidence": {
"type": "number",
"description": "Minimum AI confidence score 0-100"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "20000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/c2",
"mimeType": "application/json",
"description": "C2 infrastructure from Telegram. Filters: framework(cobalt_strike|sliver|havoc|brute_ratel), severity, min_confidence, since, tag, limit, offset. Returns items[] with C2 IPs/domains, MITRE TTPs, confidence."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"tag": "c2",
"limit": 20,
"since": "2026-05-01T00:00:00Z",
"offset": 0,
"severity": "high",
"framework": "cobalt_strike",
"min_confidence": 70
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "c2a1b2c3-d4e5-f6a7-b8c9-d0e1f2a3b4c5",
"ts": "2026-05-27T09:15:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "ip",
"value": "91.92[.]109.83",
"context": "Cobalt Strike team server"
},
{
"type": "domain",
"value": "windowsupdate[.]xyz",
"context": "Malleable C2 domain"
},
{
"type": "url",
"value": "https://91.92[.]109.83/updates",
"context": "Beacon callback URL"
}
],
"tags": [
"cobalt-strike",
"malleable-c2",
"windows-masquerade"
],
"ttps": [
{
"id": "T1071.001",
"name": "Application Layer Protocol: Web Protocols",
"tactic": "Command and Control"
},
{
"id": "T1573.001",
"name": "Encrypted Channel: Symmetric Cryptography",
"tactic": "Command and Control"
}
],
"channel": "https://t[.]me/malwrhunterteam",
"summary": "Cobalt Strike beacon detected with malleable C2 profile mimicking Microsoft update traffic",
"category": "c2",
"severity": "critical",
"confidence": 90
}
],
"limit": 20,
"total": 8,
"offset": 0,
"source": "TeleSint",
"endpoint": "c2"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"description": "Tag keyword filter, e.g. cobalt-strike, sliver, c2"
},
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"since": {
"type": "string",
"description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"severity": {
"type": "string",
"description": "Minimum severity: critical | high | medium | low | info"
},
"framework": {
"type": "string",
"description": "C2 framework: cobalt_strike | sliver | havoc | brute_ratel | metasploit"
},
"min_confidence": {
"type": "number",
"description": "Minimum AI confidence score 0-100"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "20000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/source",
"mimeType": "application/json",
"description": "Raw source verification for a TeleSint record. Pass id (UUID from any items[].id). Returns original defanged message text and source language alongside the AI summary for provenance checks."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
"include_raw": "true"
}
},
"output": {
"type": "json",
"example": {
"id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
"ts": "2026-06-10T14:32:00Z",
"source": "TeleSint",
"channel": "hxxps://t[.]me/vxunderground",
"summary": "New Cobalt Strike C2 beacon observed at 91.92.109.83 using malleable C2 profile mimicking Microsoft update traffic. Initial access via spear-phishing (T1566.001).",
"category": "ioc",
"endpoint": "source",
"raw_text": "⚡️ Новый C2: 91[.]92[.]109[.]83 — Cobalt Strike маллируемый профиль. Вектор: spear-phishing -> T1566.001",
"translated": true,
"ingested_at": "2026-06-10T14:33:01Z",
"provenance_note": "This record was translated from the original source language. The raw_text field contains the defanged original. The summary field is the AI-generated English interpretation — treat it as analyst-grade, not verbatim.",
"source_language": "ru"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Record UUID from any TeleSint endpoint items[].id"
},
"include_raw": {
"type": "string",
"description": "Return original raw_text bytes (defanged). Default: true"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "50000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/feed",
"mimeType": "application/json",
"description": "Full intel feed across all categories. Filters: category(ioc|c2|actor|breach|intent|vulnerability), severity, min_confidence, since, tag, tlp, limit, offset. Returns all record types newest first. Use for SIEM ingestion."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"tag": "ransomware",
"tlp": "WHITE",
"limit": 20,
"since": "2026-05-01T00:00:00Z",
"offset": 0,
"category": "ioc",
"severity": "high",
"min_confidence": 60
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "f1e2e3d4-5678-90ab-cdef-123456789abc",
"ts": "2026-05-27T14:32:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "sha256",
"value": "d4e5f6a7b8c9d0e1...",
"context": "Ransomware dropper"
}
],
"tags": [
"blackcat",
"alphv",
"ransomware"
],
"ttps": [
{
"id": "T1486",
"name": "Data Encrypted for Impact",
"tactic": "Impact"
}
],
"channel": "https://t[.]me/vxunderground",
"summary": "New ransomware dropper IOCs from BlackCat/ALPHV campaign",
"category": "ioc",
"severity": "critical",
"confidence": 88
}
],
"limit": 20,
"total": 156,
"offset": 0,
"source": "TeleSint",
"endpoint": "feed"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"description": "Tag keyword filter, e.g. ransomware, cobalt-strike, apt"
},
"tlp": {
"type": "string",
"description": "TLP classification: WHITE | GREEN | AMBER | RED"
},
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"since": {
"type": "string",
"description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"category": {
"type": "string",
"description": "Intel category filter: ioc | c2 | actor | breach | intent | vulnerability"
},
"severity": {
"type": "string",
"description": "Minimum severity: critical | high | medium | low | info"
},
"min_confidence": {
"type": "number",
"description": "Minimum AI confidence score 0-100"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
}
] UPTIME
RESPONSE TIME
30d UPTIME 100%
UPTIME 30D 100%
AVG RESP 168ms
TOTAL CHECKS 68
RECENT CHECKS
TIME STATUS RESP
● OK 113ms
● OK 163ms
● OK 155ms
● OK 181ms
● OK 184ms
● OK 168ms
● OK 193ms
● OK 193ms
● OK 203ms
● OK 180ms
● OK 169ms
● OK 187ms
● OK 190ms
● OK 192ms
● OK 159ms
● OK 171ms
● OK 195ms
● OK 169ms
OVER TIME
All charts share the 30d window selected here. Every series is also served as JSON at /api/v1/services/telesint/price, /scores, /volume and /buyers. On-chain volume and distinct buyers are measured over the service's settlement address and are a conservative undercount (only settlements that reach a measured facilitator are counted).
PRICE (captured 402, USD)
Median across 10 endpoints. Use the selector to isolate one.
SUB-SCORES (uptime + x402 compliance)
VOLUME (on-chain settlement, USD)
DISTINCT BUYERS
COMPLIANCE
11/11 checks pass · grade A- 402 payload captured
- accepts[] array present
- payTo address recoverable
- payTo at accepts[0].payTo (conformant shape)
- payTo is a valid on-chain address
- atomic price declared
- atomic price in a sane range
- asset (token) address declared
- network resolves to CAIP-2
- payment scheme declared
- served over HTTPS
EMBED THIS BADGE
// HTML
<a href="https://x402-list.com/services/telesint?utm_source=badge&utm_medium=referral&utm_campaign=embed"> <img src="https://x402-list.com/badge/telesint.svg" alt="TeleSint listed on x402-list" height="28"> </a>
// Markdown
[](https://x402-list.com/services/telesint?utm_source=badge&utm_medium=referral&utm_campaign=embed)
// HTML · live uptime variant
<a href="https://x402-list.com/services/telesint?utm_source=badge&utm_medium=referral&utm_campaign=embed"> <img src="https://x402-list.com/badge/telesint.svg?data=uptime" alt="TeleSint uptime on x402-list" height="28"> </a>