TeleSint
externalReal-time cyber threat intelligence sourced from public Telegram CTI channels. Eleven pay-per-call endpoints covering IOC extraction (IPs, domains, hashes, CVEs), C2 infrastructure lookup, threat actor profiles, breach disclosures, pre-attack intent signals, vulnerability and exploitation-in-the-wild tracking, ransomware group activity, malware family intelligence, dark web monitoring, cross-category keyword search, and a unified threat feed. All records are AI-enriched by DeepSeek with MITRE ATT&CK technique tagging, confidence scoring (0-100), TLP classification, and structured JSON output. No API key — USDC micropayments on Base mainnet via x402.
Price
from $0.0100
up to $0.0500 per request
Network
base
Category
ai
On-chain txns
0
Uptime
100%
Avg latency
363ms
Checks
64
Status
Healthy
Base URL
Endpoints (14)
Discovered from on-chain x402 payment activity. Prices shown are per-call in USDC.
Threat actor profiles from Telegram. Filters: name, nation_state(kp|ru|cn|ir), motivation(financial|espionage|hacktivism), ttp, severity, limit. Returns items[] with actor{}, ttps[], target{sectors,countries}.
CTI artifact export from a TeleSint record. Required: id (record UUID), format (sigma|stix|report). Returns Sigma rule, STIX 2.1 bundle, or structured analyst report built from real enriched intel.
ASN threat intel from Telegram CTI channels. Pass ?asn=AS215540. Returns C2/phishing-kit associations, threat actor mentions, bulletproof hosting flag, blocking recommendation with WAF hint, and record IDs for pivoting into /c2 or /ioc.
Breach disclosures from Telegram. Filters: sector, country, organization, severity, min_confidence, since, limit. Returns items[] with target{sectors,countries,organizations}, leak iocs[], confidence.
C2 infrastructure from Telegram. Filters: framework(cobalt_strike|sliver|havoc|brute_ratel), severity, min_confidence, since, tag, limit, offset. Returns items[] with C2 IPs/domains, MITRE TTPs, confidence.
Dark web intelligence from Telegram: marketplace listings, forum chatter, access broker posts, credential shops, Tor site activity. Filters: severity, min_confidence, since, tag, sector, country, organization, limit, offset.
Full intel feed across all categories. Filters: category(ioc|c2|actor|breach|intent|vulnerability), severity, min_confidence, since, tag, tlp, limit, offset. Returns all record types newest first. Use for SIEM ingestion.
Pre-attack intent signals from Telegram: access sales, 0days, ransomware targeting. Filters: sector, country, organization, intent_type(access_sale|0day|ransomware|exploit), limit. Signals appear before attacks.
IOC feed from Telegram CTI channels. Filters: type(ip|domain|url|hash|cve), severity, min_confidence, since, tlp, tag, channel, limit, offset. Returns items[] with iocs[], ttps[], confidence, severity, tlp, tags[].
Malware family intelligence from Telegram: new sample drops, behavior analysis, loader/stealer/RAT/backdoor writeups. Filters: severity, min_confidence, since, tag(stealer|loader|rat|backdoor), limit, offset.
Ransomware group activity from Telegram: victim posts, leak site announcements, extortion demands. Filters: severity, min_confidence, since, tag(lockbit|blackcat|cl0p|ransomhub), sector, country, limit, offset.
Cross-category pivot across all TeleSint intel. Use ?q= for broad keyword or combine filters: category, severity, sector, country, tag, ttp, name, organization, min_confidence, since. Returns items[] across any category.
Raw source verification for a TeleSint record. Pass id (UUID from any items[].id). Returns original defanged message text and source language alongside the AI summary for provenance checks.
CVE and exploitation-in-the-wild signals from Telegram CTI channels. Filters: severity, min_confidence, since, tag(cve|exploit|poc|patch), ttp, type(cve), limit, offset. Returns CVE IDs, affected products, exploit status.
Payment
How to call
# one-time setup
npx @apihubio/cli register
npx @apihubio/cli topup 10
# call it
npx @apihubio/cli call https://telesint-api.onrender.com \
-X POST \
-d '{ /* check provider docs for input */ }'
# or save it to Claude/Cursor/Codex
npx @apihubio/cli install
npx @apihubio/cli add https://telesint-api.onrender.comVia direct x402 (advanced)Bring your own wallet
import { wrapFetchWithPayment } from "@x402/fetch";
import { createWalletClient, http } from "viem";
import { privateKeyToAccount } from "viem/accounts";
import { base } from "viem/chains";
const account = privateKeyToAccount("0xYOUR_PRIVATE_KEY");
const client = createWalletClient({ account, chain: base, transport: http() });
const x402Fetch = wrapFetchWithPayment(client);
const res = await x402Fetch("https://telesint-api.onrender.com", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ /* check provider docs for input */ }),
});
const data = await res.json();This is an external service not operated by APIHub. Listing data is sourced from public on-chain records and third-party indexes. Payment goes directly to the service provider via the x402 protocol. APIHub does not guarantee availability, accuracy, or quality of external services.