Api Endpoint

telesint-api.onrender.com

IOC feed from Telegram CTI channels. Filters: ip (exact lookup), type(ip|domain|url|md5|sha1|sha256|cve), severity, min_confidence, since, tlp, tag, channel, limit, offset. Returns items[] with iocs[], ttps[], confidence, severity, tlp, tags[].

Open interactive test console

Offering

Provider: telesint-api.onrender.com
Method: GET
Offering type: Api Endpoint
Transport type: http
Category: Security
Delivery: Not provided
Pricing model: Not provided
x402 version: 2

Endpoint context

URL: https://telesint-api.onrender.com/ioc
MIME type: application/json
First seen: 2026-10-16T01:50:53.972Z
Last seen: 2026-11-04T15:27:31.860Z
Tags: None supplied

Website

Payment pricing

x402 payment terms are the authoritative price for calling this endpoint.

Payment option 1: 0.01 USDC
Atomic price: 10000 · Network: eip155:8453 · Asset: USDC · Scheme: exact

Raw x402 terms

[
  {
    "scheme": "exact",
    "network": "eip155:8453",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "amount": "10000",
    "payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F"
  }
]

Observed health

Status: Healthy
Latest latency: 147 ms
Average latency: 221 ms
HTTP status: 402
Last checked: 2026-11-04T15:27:31.855Z
Reachability: 100% over 5 checks

Latency is measured to the first response headers. A reachable result does not verify response accuracy or merchant identity.

Input schema

{
  "type": "object",
  "properties": {
    "type": {
      "type": "string",
      "const": "http"
    },
    "method": {
      "type": "string",
      "enum": [
        "GET"
      ]
    },
    "queryParams": {
      "type": "object",
      "properties": {
        "ip": {
          "type": "string",
          "description": "Exact IPv4/IPv6 lookup: return records whose IOCs include this address, e.g. 185.220.101.47"
        },
        "type": {
          "type": "string",
          "description": "IOC type: ip | domain | url | md5 | sha1 | sha256 | cve"
        },
        "severity": {
          "type": "string",
          "description": "Minimum severity: critical | high | medium | low | info"
        },
        "min_confidence": {
          "type": "number",
          "description": "Minimum AI confidence score 0-100"
        },
        "since": {
          "type": "string",
          "description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
        },
        "tlp": {
          "type": "string",
          "description": "TLP classification: WHITE | GREEN | AMBER | RED"
        },
        "tag": {
          "type": "string",
          "description": "Tag keyword filter, e.g. ransomware, cobalt-strike, apt"
        },
        "channel": {
          "type": "string",
          "description": "Partial match on source Telegram channel name"
        },
        "limit": {
          "type": "number",
          "description": "Page size, default 20, max 100"
        },
        "offset": {
          "type": "number",
          "description": "Pagination offset, default 0"
        },
        "kev": {
          "type": "string",
          "description": "true = only records whose CVEs are in the CISA Known Exploited Vulnerabilities catalog"
        },
        "provenance": {
          "type": "string",
          "description": "observed (actor-side claim/sale/announcement) | reported (researcher/vendor/news report) | unknown"
        },
        "claim_type": {
          "type": "string",
          "description": "announcement | claim | sale | recruitment | propaganda | report"
        }
      }
    }
  },
  "required": [
    "type",
    "method"
  ],
  "additionalProperties": false
}

Output schema

{
  "type": "json",
  "example": {
    "items": [
      {
        "id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
        "ts": "2026-05-27T14:32:00Z",
        "tlp": "WHITE",
        "iocs": [
          {
            "type": "url",
            "value": "https://github[.]com/Nightmare-Eclipse/MiniPlasma",
            "context": "Exploit repository"
          },
          {
            "type": "ip",
            "value": "185.220[.]101.47",
            "context": "C2 callback address"
          },
          {
            "type": "sha256",
            "value": "e3b0c44298fc1c149afb4c8996fb924...",
            "context": "Dropper hash"
          }
        ],
        "tags": [
          "zero-day",
          "windows",
          "government",
          "exploit"
        ],
        "ttps": [
          {
            "id": "T1204.002",
            "name": "User Execution: Malicious File",
            "tactic": "Execution"
          },
          {
            "id": "T1071.001",
            "name": "Application Layer Protocol: Web Protocols",
            "tactic": "Command and Control"
          }
        ],
        "channel": "https://t[.]me/vxunderground",
        "summary": "Windows zero-day exploit released by Nightmare Eclipse threat group targeting government networks",
        "category": "ioc",
        "severity": "high",
        "confidence": 80
      }
    ],
    "limit": 20,
    "total": 42,
    "offset": 0,
    "source": "TeleSint",
    "endpoint": "ioc"
  }
}