payment-ready until 2026-09-30
imported from the x402 Bazaar, not submitted by the operator · own this service? claim it · or ask to be removed
Threat intelligence API that extracts indicators of compromise, C2 infrastructure, threat actor profiles, breach disclosures and CVE signals from public Telegram security channels, returned as structured JSON with MITRE ATT&CK tags and confidence scores.
Pay from $0.01 to $0.05 per request in USDC on Base, settled onchain via the x402 protocol, no signup, no API key needed.
measured since 2026-05-22 (start of our harvest window) · $119.89 all-time · settled via coinbase
VERDICT
ranking generation 3solid 85/100 #105 of 314 in Data by measured score
What the score read on this service: status online, 100% uptime 30d, 411ms response p95, x402 compliance 14 of 14, $0.01 price against the category, on-chain traction measured. Each of those is measured, and each is published in full below.
The score comes from our own monitoring, never from reviews, operator claims, or a language model: reliability, x402 compliance, price against the category, a deterministic risk flag, and a small on-chain traction term, weighted by ranking generation 3. It is not placement anyone can buy: the paid verify tier is reported beside it and is not one of its inputs. Every component below stays published and read-only.
It is a score inside Data, and only there: price and speed are scored against the whole category field, every listing in it that carries no danger flag, the scored service included, which here means 314 listings, this one among them. That set is wider than the 314 the position above is counted against, because a listing we have measured too little of to rank still sits in the field the price and the speed are normalized over. The same service in a different field would read differently. The same engine answers GET /api/v1/best, and asked for a different pool (the whole directory, or another filter) it returns a different number for this service under this same ranking generation. Neither is more correct: they answer different questions, and the methodology states which is which.
Bands on the 0 to 100 measured score: strong at 93 and above, solid from 75, mixed from 55, weak below 55. Price and speed are scored against the whole category field, every listing in it that carries no danger flag, the scored service included, so the score places a service in its own field.
ALTERNATIVES IN DATA
Other Data services in this directory, ordered by the same measured score. The figures are ours: 30-day uptime from our own probes, 30-day settlement volume read on-chain (a conservative undercount, and null where we cannot measure it, never a zero).
| SERVICE | BAND | SCORE | UPTIME 30D | VOL 30D |
|---|---|---|---|---|
| StableEnrich | strong | 96 | 100% | $2.0k |
| glim.sh | strong | 95 | 100% | $47.10 |
| SniperX•x402 | strong | 95 | 100% | $320.81 |
| cn402 | strong | 94 | 100% | $36.45 |
| API Acre | solid | 92 | 99.5% | $31.95 |
5 of 313 other ranked services in Data · see the whole category
ASSESSMENT
updated 5h agoThe parts the verdict above is computed from, each with its proof. Click any chip. Measured values stay read-only; unknown is honest, and an unknown is never counted as a zero.
reliability 100%
- uptime 24h
- 100%
- uptime 7d
- 100%
- uptime 30d
- 100%
- uptime 90d
- 100%
- response p95
- 411ms
- avg response
- 281ms
- total checks
- 2,783
Measured on the unpaid 402 handshake, not the paid call. A service can 402 correctly and still fail after payment.
compliance A (14/14)
14 of 14 x402 conformance checks pass. Full checklist below.
price $0.01 to $0.05 (p60 in Data)
- price (min)
- $0.01
- price (max)
- $0.05
- category percentile (min)
- p60 in Data
- category percentile (max)
- p60 in Data
- endpoints / prices
- 10 / 4
- model
- tiered
- stability
- 100%
risk clean
No deterministic risk flag. Risk fires only on an exact blocklist match, or a reserved-brand name with a mismatched verified payTo. Never from low uptime, a high price, or a model guess.
- domain age
- -
- registrar
- -
- hosting
- free host
- domain created
- ---
Identity facts, not a risk score.
traction $0.95 30d · 12 buyers
- volume 30d
- $0.95
- buyers 30d
- 12
- settlements 30d
- 69
- measured since
- 2026-05-22 (start of our harvest window)
- last settlement
- 2026-09-23
- top buyer share
- 49% of 30d volume
- trend 7d vs 30d
- 0.99x the 30d daily rate
- networks
- eip155:8453
- volume all-time
- $119.89
- settlements all-time
- 3,758
- median settlement 30d
- $0.01
- max settlement 30d
- $0.05
- settled via
- coinbase ($0.95, 69 tx)
Conservative undercount: only USDC settlements via facilitators we measure are counted. A measured floor, not an estimate.
Top buyer share is a concentration signal, not part of the ranking score.
WHAT IT DOES
ai-derivedNo AI synthesis has been produced for this service yet.
ENDPOINTS
| METHOD | PATH | DESCRIPTION | PRICE | NETWORK | ASSET | 402 CHANNEL |
|---|---|---|---|---|---|---|
| GET | /artifact | $0.05 | Base | USDC | header | |
| GET | /breach | $0.03 | Base | USDC | header | |
| GET | /c2 | $0.02 | Base | USDC | header | |
| GET | /darkweb | $0.03 | Base | USDC | header | |
| GET | /feed | $0.05 | Base | USDC | header | |
| GET | /intent | $0.05 | Base | USDC | header | |
| GET | /ioc | $0.01 | Base | USDC | header | |
| GET | /malware | $0.02 | Base | USDC | header | |
| GET | /source | $0.02 | Base | USDC | header | |
| GET | /vulnerability | $0.03 | Base | USDC | header |
10 endpoints
REQUEST / RESPONSE EXAMPLE
An unpaid request to GET /artifact returns HTTP 402 with the payment terms. Settle onchain via your facilitator, then retry with the X-Payment header.
// request
curl -i 'https://telesint-api.onrender.com/artifact'
// 402 response (captured by monitor) · 10 payloads · click to expand
[
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "30000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/vulnerability",
"mimeType": "application/json",
"description": "CVE and exploitation-in-the-wild signals from Telegram CTI channels. Filters: severity, min_confidence, since, tag(cve|exploit|poc|patch), ttp, type(cve), limit, offset. Returns CVE IDs, affected products, exploit status."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"tag": "cve",
"type": "cve",
"limit": 20,
"since": "2026-05-01T00:00:00Z",
"offset": 0,
"severity": "high",
"min_confidence": 60
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "v1u2l3n4-5678-90ab-cdef-vuln56789012",
"ts": "2026-05-27T10:00:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "cve",
"value": "CVE-2026-1234",
"context": "Critical RCE in PAN-OS"
},
{
"type": "url",
"value": "https://github[.]com/exploit-db/CVE-2026-1234",
"context": "PoC repository"
}
],
"tags": [
"cve",
"rce",
"palo-alto",
"pan-os",
"poc",
"exploit-in-the-wild"
],
"ttps": [
{
"id": "T1190",
"name": "Exploit Public-Facing Application",
"tactic": "Initial Access"
},
{
"id": "T1203",
"name": "Exploitation for Client Execution",
"tactic": "Execution"
}
],
"channel": "https://t[.]me/vxunderground",
"summary": "PoC released for CVE-2026-1234 (CVSS 9.8): unauthenticated RCE in Palo Alto PAN-OS. Exploitation observed in the wild targeting government networks.",
"category": "vulnerability",
"severity": "critical",
"confidence": 91
}
],
"limit": 20,
"total": 34,
"offset": 0,
"source": "TeleSint",
"endpoint": "vulnerability"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"description": "Tag keyword filter, e.g. cve, exploit, poc, patch, zero-day"
},
"ttp": {
"type": "string",
"description": "MITRE ATT&CK technique ID prefix, e.g. T1190, T1203"
},
"type": {
"type": "string",
"description": "IOC type filter: cve"
},
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"since": {
"type": "string",
"description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"severity": {
"type": "string",
"description": "Minimum severity: critical | high | medium | low | info"
},
"min_confidence": {
"type": "number",
"description": "Minimum AI confidence score 0-100"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "50000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/artifact",
"mimeType": "application/json",
"description": "CTI artifact export from a TeleSint record. Required: id (record UUID), format (sigma|stix|report). Returns Sigma rule, STIX 2.1 bundle, or structured analyst report built from real enriched intel."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
"format": "sigma"
}
},
"output": {
"type": "json",
"example": {
"format": "stix",
"source": "TeleSint",
"artifact": {
"id": "bundle--f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
"type": "bundle",
"objects": [
{
"id": "indicator--f8a3c1d2-ip-0",
"name": "IP: 91.92.109.83",
"type": "indicator",
"labels": [
"malicious-activity"
],
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.92.109.83']",
"confidence": 90,
"valid_from": "2026-05-27T09:15:00Z",
"pattern_type": "stix",
"spec_version": "2.1"
},
{
"id": "attack-pattern--f8a3c1d2-T1071-001",
"name": "Application Layer Protocol: Web Protocols",
"type": "attack-pattern",
"spec_version": "2.1",
"external_references": [
{
"external_id": "T1071.001",
"source_name": "mitre-attack"
}
]
},
{
"id": "report--f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
"name": "Cobalt Strike beacon with malleable C2 profile mimicking Microsoft update traffic",
"type": "report",
"labels": [
"c2",
"cobalt-strike",
"malleable-c2"
],
"confidence": 90,
"spec_version": "2.1"
}
],
"spec_version": "2.1"
},
"category": "c2",
"endpoint": "artifact",
"record_id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
"generated_at": "2026-06-01T12:00:00Z"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"id",
"format"
],
"properties": {
"id": {
"type": "string",
"description": "Intel record UUID from any TeleSint endpoint response (items[].id)"
},
"format": {
"type": "string",
"description": "Artifact format: sigma (detection rule) | stix (STIX 2.1 bundle) | report (analyst report)"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "10000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/ioc",
"mimeType": "application/json",
"description": "IOC feed from Telegram CTI channels. Filters: type(ip|domain|url|hash|cve), severity, min_confidence, since, tlp, tag, channel, limit, offset. Returns items[] with iocs[], ttps[], confidence, severity, tlp, tags[]."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"tag": "ransomware",
"tlp": "WHITE",
"type": "ip",
"limit": 20,
"since": "2026-05-01T00:00:00Z",
"offset": 0,
"channel": "vxunderground",
"severity": "high",
"min_confidence": 70
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
"ts": "2026-05-27T14:32:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "url",
"value": "https://github[.]com/Nightmare-Eclipse/MiniPlasma",
"context": "Exploit repository"
},
{
"type": "ip",
"value": "185.220[.]101.47",
"context": "C2 callback address"
},
{
"type": "sha256",
"value": "e3b0c44298fc1c149afb4c8996fb924...",
"context": "Dropper hash"
}
],
"tags": [
"zero-day",
"windows",
"government",
"exploit"
],
"ttps": [
{
"id": "T1204.002",
"name": "User Execution: Malicious File",
"tactic": "Execution"
},
{
"id": "T1071.001",
"name": "Application Layer Protocol: Web Protocols",
"tactic": "Command and Control"
}
],
"channel": "https://t[.]me/vxunderground",
"summary": "Windows zero-day exploit released by Nightmare Eclipse threat group targeting government networks",
"category": "ioc",
"severity": "high",
"confidence": 80
}
],
"limit": 20,
"total": 42,
"offset": 0,
"source": "TeleSint",
"endpoint": "ioc"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"description": "Tag keyword filter, e.g. ransomware, cobalt-strike, apt"
},
"tlp": {
"type": "string",
"description": "TLP classification: WHITE | GREEN | AMBER | RED"
},
"type": {
"type": "string",
"description": "IOC type: ip | domain | url | md5 | sha1 | sha256 | cve"
},
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"since": {
"type": "string",
"description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"channel": {
"type": "string",
"description": "Partial match on source Telegram channel name"
},
"severity": {
"type": "string",
"description": "Minimum severity: critical | high | medium | low | info"
},
"min_confidence": {
"type": "number",
"description": "Minimum AI confidence score 0-100"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "30000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/darkweb",
"mimeType": "application/json",
"description": "Dark web intelligence from Telegram: marketplace listings, forum chatter, access broker posts, credential shops, Tor site activity. Filters: severity, min_confidence, since, tag, sector, country, organization, limit, offset."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"tag": "access-broker",
"limit": 20,
"since": "2026-05-01T00:00:00Z",
"offset": 0,
"sector": "finance",
"severity": "high",
"min_confidence": 60
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "d1a2r3k4-w5e6-7890-abcd-darkweb78901",
"ts": "2026-05-27T06:45:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "url",
"value": "https://exploit[.]in/threads/healthcare-access-12345",
"context": "Underground forum listing"
}
],
"tags": [
"access-broker",
"healthcare",
"initial-access",
"domain-admin",
"exploit-in"
],
"ttps": [
{
"id": "T1078",
"name": "Valid Accounts",
"tactic": "Initial Access"
}
],
"target": {
"sectors": [
"healthcare"
],
"countries": [
"US"
],
"organizations": []
},
"channel": "https://t[.]me/darkwebinformer",
"summary": "Access broker selling domain admin access to US healthcare network (5,000 employees) — asking $15,000 on exploit.in forum",
"category": "darkweb",
"severity": "critical",
"confidence": 78
}
],
"limit": 20,
"total": 14,
"offset": 0,
"source": "TeleSint",
"endpoint": "darkweb"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"description": "Tag keyword: access-broker | credential-shop | combo-list | carding | forum | marketplace"
},
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"since": {
"type": "string",
"description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"sector": {
"type": "string",
"description": "Targeted sector: finance | healthcare | government | energy | retail"
},
"country": {
"type": "string",
"description": "Targeted country keyword, e.g. us | uk | de | fr"
},
"severity": {
"type": "string",
"description": "Minimum severity: critical | high | medium | low | info"
},
"organization": {
"type": "string",
"description": "Targeted organization name partial match"
},
"min_confidence": {
"type": "number",
"description": "Minimum AI confidence score 0-100"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "20000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/malware",
"mimeType": "application/json",
"description": "Malware family intelligence from Telegram: new sample drops, behavior analysis, loader/stealer/RAT/backdoor writeups. Filters: severity, min_confidence, since, tag(stealer|loader|rat|backdoor), limit, offset."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"tag": "stealer",
"limit": 20,
"since": "2026-05-01T00:00:00Z",
"offset": 0,
"severity": "high",
"min_confidence": 60
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "m1a2l3w4-a5r6-7890-abcd-malware78901",
"ts": "2026-05-27T11:00:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "sha256",
"value": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
"context": "Lumma Stealer sample"
},
{
"type": "domain",
"value": "lumma-panel[.]xyz",
"context": "C2 panel domain"
}
],
"tags": [
"lumma",
"stealer",
"maas",
"infostealer",
"chrome"
],
"ttps": [
{
"id": "T1555.003",
"name": "Credentials from Web Browsers",
"tactic": "Credential Access"
},
{
"id": "T1071.001",
"name": "Application Layer Protocol: Web Protocols",
"tactic": "Command and Control"
}
],
"channel": "https://t[.]me/vxunderground",
"summary": "New Lumma Stealer v4.1 released with browser cookie bypass targeting Chrome 124+ — sold as MaaS on underground forums",
"category": "malware",
"severity": "high",
"confidence": 85
}
],
"limit": 20,
"total": 19,
"offset": 0,
"source": "TeleSint",
"endpoint": "malware"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"description": "Malware type tag: stealer | loader | rat | backdoor | botnet | worm | dropper | rootkit"
},
"ttp": {
"type": "string",
"description": "MITRE ATT&CK technique ID prefix, e.g. T1059, T1071"
},
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"since": {
"type": "string",
"description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"severity": {
"type": "string",
"description": "Minimum severity: critical | high | medium | low | info"
},
"min_confidence": {
"type": "number",
"description": "Minimum AI confidence score 0-100"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "50000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/intent",
"mimeType": "application/json",
"description": "Pre-attack intent signals from Telegram: access sales, 0days, ransomware targeting. Filters: sector, country, organization, intent_type(access_sale|0day|ransomware|exploit), limit. Signals appear before attacks."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"limit": 20,
"offset": 0,
"sector": "healthcare",
"country": "us",
"intent_type": "ransomware",
"organization": "hospital"
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "i1n2t3e4-n5t6-7890-abcd-intent789012",
"ts": "2026-05-27T07:22:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "url",
"value": "https://exploit[.]in/threads/healthcare-access",
"context": "Access sale listing"
}
],
"tags": [
"access-sale",
"healthcare",
"vpn",
"initial-access-broker"
],
"ttps": [
{
"id": "T1078",
"name": "Valid Accounts",
"tactic": "Initial Access"
},
{
"id": "T1110",
"name": "Brute Force",
"tactic": "Credential Access"
}
],
"target": {
"sectors": [
"healthcare"
],
"countries": [
"US"
],
"organizations": []
},
"channel": "https://t[.]me/ctifeeds",
"summary": "Threat actor selling VPN access to US healthcare network: 5,000 employee credentials, domain admin included",
"category": "intent",
"severity": "critical",
"confidence": 72
}
],
"limit": 20,
"total": 3,
"offset": 0,
"source": "TeleSint",
"endpoint": "intent"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"sector": {
"type": "string",
"description": "Targeted sector: finance | healthcare | government | energy | retail"
},
"country": {
"type": "string",
"description": "Targeted country keyword, e.g. us | uk | de | fr"
},
"intent_type": {
"type": "string",
"description": "Signal type: access_sale | 0day | ransomware | exploit | recruitment"
},
"organization": {
"type": "string",
"description": "Targeted organization name partial match"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "30000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/breach",
"mimeType": "application/json",
"description": "Breach disclosures from Telegram. Filters: sector, country, organization, severity, min_confidence, since, limit. Returns items[] with target{sectors,countries,organizations}, leak iocs[], confidence."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"limit": 20,
"since": "2026-05-01T00:00:00Z",
"offset": 0,
"sector": "finance",
"country": "us",
"severity": "high",
"organization": "acme",
"min_confidence": 60
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "b1r2e3a4-c5h6-7890-abcd-123456789012",
"ts": "2026-05-27T11:45:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "url",
"value": "https://lockbit3[.]onion/leak/usbank-data",
"context": "Ransomware leak site"
}
],
"tags": [
"lockbit",
"ransomware",
"finance",
"data-leak",
"pii"
],
"ttps": [
{
"id": "T1486",
"name": "Data Encrypted for Impact",
"tactic": "Impact"
},
{
"id": "T1041",
"name": "Exfiltration Over C2 Channel",
"tactic": "Exfiltration"
}
],
"target": {
"sectors": [
"finance"
],
"countries": [
"US"
],
"organizations": [
"Regional Bank Corp"
]
},
"channel": "https://t[.]me/cyberinsider",
"summary": "LockBit claims breach of US regional bank: 2.4M customer records including SSNs and account numbers",
"category": "breach",
"severity": "critical",
"confidence": 75
}
],
"limit": 20,
"total": 17,
"offset": 0,
"source": "TeleSint",
"endpoint": "breach"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"since": {
"type": "string",
"description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"sector": {
"type": "string",
"description": "Targeted sector: finance | healthcare | government | energy | retail"
},
"country": {
"type": "string",
"description": "Targeted country keyword, e.g. us | uk | de | fr"
},
"severity": {
"type": "string",
"description": "Minimum severity: critical | high | medium | low | info"
},
"organization": {
"type": "string",
"description": "Targeted organization name partial match"
},
"min_confidence": {
"type": "number",
"description": "Minimum AI confidence score 0-100"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "20000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/c2",
"mimeType": "application/json",
"description": "C2 infrastructure from Telegram. Filters: framework(cobalt_strike|sliver|havoc|brute_ratel), severity, min_confidence, since, tag, limit, offset. Returns items[] with C2 IPs/domains, MITRE TTPs, confidence."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"tag": "c2",
"limit": 20,
"since": "2026-05-01T00:00:00Z",
"offset": 0,
"severity": "high",
"framework": "cobalt_strike",
"min_confidence": 70
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "c2a1b2c3-d4e5-f6a7-b8c9-d0e1f2a3b4c5",
"ts": "2026-05-27T09:15:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "ip",
"value": "91.92[.]109.83",
"context": "Cobalt Strike team server"
},
{
"type": "domain",
"value": "windowsupdate[.]xyz",
"context": "Malleable C2 domain"
},
{
"type": "url",
"value": "https://91.92[.]109.83/updates",
"context": "Beacon callback URL"
}
],
"tags": [
"cobalt-strike",
"malleable-c2",
"windows-masquerade"
],
"ttps": [
{
"id": "T1071.001",
"name": "Application Layer Protocol: Web Protocols",
"tactic": "Command and Control"
},
{
"id": "T1573.001",
"name": "Encrypted Channel: Symmetric Cryptography",
"tactic": "Command and Control"
}
],
"channel": "https://t[.]me/malwrhunterteam",
"summary": "Cobalt Strike beacon detected with malleable C2 profile mimicking Microsoft update traffic",
"category": "c2",
"severity": "critical",
"confidence": 90
}
],
"limit": 20,
"total": 8,
"offset": 0,
"source": "TeleSint",
"endpoint": "c2"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"description": "Tag keyword filter, e.g. cobalt-strike, sliver, c2"
},
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"since": {
"type": "string",
"description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"severity": {
"type": "string",
"description": "Minimum severity: critical | high | medium | low | info"
},
"framework": {
"type": "string",
"description": "C2 framework: cobalt_strike | sliver | havoc | brute_ratel | metasploit"
},
"min_confidence": {
"type": "number",
"description": "Minimum AI confidence score 0-100"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "20000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/source",
"mimeType": "application/json",
"description": "Raw source verification for a TeleSint record. Pass id (UUID from any items[].id). Returns original defanged message text and source language alongside the AI summary for provenance checks."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
"include_raw": "true"
}
},
"output": {
"type": "json",
"example": {
"id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
"ts": "2026-06-10T14:32:00Z",
"source": "TeleSint",
"channel": "hxxps://t[.]me/vxunderground",
"summary": "New Cobalt Strike C2 beacon observed at 91.92.109.83 using malleable C2 profile mimicking Microsoft update traffic. Initial access via spear-phishing (T1566.001).",
"category": "ioc",
"endpoint": "source",
"raw_text": "⚡️ Новый C2: 91[.]92[.]109[.]83 — Cobalt Strike маллируемый профиль. Вектор: spear-phishing -> T1566.001",
"translated": true,
"ingested_at": "2026-06-10T14:33:01Z",
"provenance_note": "This record was translated from the original source language. The raw_text field contains the defanged original. The summary field is the AI-generated English interpretation — treat it as analyst-grade, not verbatim.",
"source_language": "ru"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Record UUID from any TeleSint endpoint items[].id"
},
"include_raw": {
"type": "string",
"description": "Return original raw_text bytes (defanged). Default: true"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
"amount": "50000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://telesint-api.onrender.com/feed",
"mimeType": "application/json",
"description": "Full intel feed across all categories. Filters: category(ioc|c2|actor|breach|intent|vulnerability), severity, min_confidence, since, tag, tlp, limit, offset. Returns all record types newest first. Use for SIEM ingestion."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"tag": "ransomware",
"tlp": "WHITE",
"limit": 20,
"since": "2026-05-01T00:00:00Z",
"offset": 0,
"category": "ioc",
"severity": "high",
"min_confidence": 60
}
},
"output": {
"type": "json",
"example": {
"items": [
{
"id": "f1e2e3d4-5678-90ab-cdef-123456789abc",
"ts": "2026-05-27T14:32:00Z",
"tlp": "WHITE",
"iocs": [
{
"type": "sha256",
"value": "d4e5f6a7b8c9d0e1...",
"context": "Ransomware dropper"
}
],
"tags": [
"blackcat",
"alphv",
"ransomware"
],
"ttps": [
{
"id": "T1486",
"name": "Data Encrypted for Impact",
"tactic": "Impact"
}
],
"channel": "https://t[.]me/vxunderground",
"summary": "New ransomware dropper IOCs from BlackCat/ALPHV campaign",
"category": "ioc",
"severity": "critical",
"confidence": 88
}
],
"limit": 20,
"total": 156,
"offset": 0,
"source": "TeleSint",
"endpoint": "feed"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"description": "Tag keyword filter, e.g. ransomware, cobalt-strike, apt"
},
"tlp": {
"type": "string",
"description": "TLP classification: WHITE | GREEN | AMBER | RED"
},
"limit": {
"type": "number",
"description": "Page size, default 20, max 100"
},
"since": {
"type": "string",
"description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
},
"offset": {
"type": "number",
"description": "Pagination offset, default 0"
},
"category": {
"type": "string",
"description": "Intel category filter: ioc | c2 | actor | breach | intent | vulnerability"
},
"severity": {
"type": "string",
"description": "Minimum severity: critical | high | medium | low | info"
},
"min_confidence": {
"type": "number",
"description": "Minimum AI confidence score 0-100"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
}
] OVER TIME
All charts use the 90d selector; each series spans only the dates it has data for. Every series is also served as JSON at /api/v1/services/telesint/price, /scores, /volume and /buyers. On-chain volume and distinct buyers are measured over the service's settlement address and are a conservative undercount (only settlements that reach a measured facilitator are counted). The on-chain series roll up hourly, so the latest day can be up to about an hour behind; distinct buyers are counted per payout address, so a service that settles to more than one address is an upper bound.
UPTIME
90d UPTIME 100%
RESPONSE TIME
AVG RESP 284ms
PRICE (captured 402, USD)
Median across 10 endpoints. Use the selector to isolate one.
SUB-SCORES (uptime + x402 compliance)
checklist grew 11->14 on 2026-07-28; a step here is a metric change, not a regression
PILLARS OVER TIME (measured)
price percentile in Data
site signals present (of 6)
Measured site and economics pillars from the assessment history, so the latest value shown elsewhere on this page reads as a point on a trend rather than a permanent state.
VOLUME (on-chain settlement, USD)
DISTINCT BUYERS
COMPLIANCE
14/14 checks pass · grade Alast 402 captured 2026-07-20 · last up 2026-09-23
- 402 payload captured
- accepts[] array present
- payTo address recoverable
- payTo at accepts[0].payTo (conformant shape)
- payTo is a valid on-chain address
- atomic price declared
- atomic price in a sane range
- asset (token) address declared
- network resolves to CAIP-2
- payment scheme declared
- served over HTTPS
- declares the current x402 version (2)
- EIP-712 domain parameters present on every EVM entry
- x402 v2 envelope delivered in the payment-required header
SITE PILLARS
- homepage reachable
- openapi doc
- pricing page
- llms.txt
- robots.txt
- terms page
recent checks (18) live · click to expand
TIME STATUS RESP CAUSE
● OK 122ms
● OK 156ms
● OK 163ms
● OK 309ms
● OK 117ms
● OK 80ms
● OK 246ms
● OK 210ms
● OK 194ms
● OK 228ms
● OK 182ms
● OK 287ms
● OK 245ms
● OK 295ms
● OK 351ms
● OK 276ms
● OK 243ms
● OK 256ms
EMBED THIS BADGE
// HTML
<a href="https://x402-list.com/services/telesint?utm_source=badge&utm_medium=referral&utm_campaign=embed"> <img src="https://x402-list.com/badge/telesint.svg" alt="TeleSint listed on x402-list" height="28"> </a>
// Markdown
[](https://x402-list.com/services/telesint?utm_source=badge&utm_medium=referral&utm_campaign=embed)
// HTML · live uptime variant
<a href="https://x402-list.com/services/telesint?utm_source=badge&utm_medium=referral&utm_campaign=embed"> <img src="https://x402-list.com/badge/telesint.svg?data=uptime" alt="TeleSint uptime on x402-list" height="28"> </a>