{
  "x402Version": 2,
  "id": 5053,
  "slug": "5053",
  "resource": "https://telesint-api.onrender.com/ioc",
  "description": "IOC feed from Telegram CTI channels. Filters: type(ip|domain|url|hash|cve), severity, min_confidence, since, tlp, tag, channel, limit, offset. Returns items[] with iocs[], ttps[], confidence, severity, tlp, tags[].",
  "type": "http",
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "amount": "10000",
      "maxTimeoutSeconds": 300
    }
  ],
  "outputSchema": {
    "bazaar": {
      "info": {
        "input": {
          "method": "GET",
          "queryParams": {
            "channel": "vxunderground",
            "limit": 20,
            "min_confidence": 70,
            "offset": 0,
            "severity": "high",
            "since": "2026-05-01T00:00:00Z",
            "tag": "ransomware",
            "tlp": "WHITE",
            "type": "ip"
          },
          "type": "http"
        },
        "output": {
          "example": {
            "endpoint": "ioc",
            "items": [
              {
                "category": "ioc",
                "channel": "https://t[.]me/vxunderground",
                "confidence": 80,
                "id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
                "iocs": [
                  {
                    "context": "Exploit repository",
                    "type": "url",
                    "value": "https://github[.]com/Nightmare-Eclipse/MiniPlasma"
                  },
                  {
                    "context": "C2 callback address",
                    "type": "ip",
                    "value": "185.220[.]101.47"
                  },
                  {
                    "context": "Dropper hash",
                    "type": "sha256",
                    "value": "e3b0c44298fc1c149afb4c8996fb924..."
                  }
                ],
                "severity": "high",
                "summary": "Windows zero-day exploit released by Nightmare Eclipse threat group targeting government networks",
                "tags": [
                  "zero-day",
                  "windows",
                  "government",
                  "exploit"
                ],
                "tlp": "WHITE",
                "ts": "2026-05-27T14:32:00Z",
                "ttps": [
                  {
                    "id": "T1204.002",
                    "name": "User Execution: Malicious File",
                    "tactic": "Execution"
                  },
                  {
                    "id": "T1071.001",
                    "name": "Application Layer Protocol: Web Protocols",
                    "tactic": "Command and Control"
                  }
                ]
              }
            ],
            "limit": 20,
            "offset": 0,
            "source": "TeleSint",
            "total": 42
          },
          "type": "json"
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "input": {
            "additionalProperties": false,
            "properties": {
              "method": {
                "enum": [
                  "GET"
                ],
                "type": "string"
              },
              "queryParams": {
                "properties": {
                  "channel": {
                    "description": "Partial match on source Telegram channel name",
                    "type": "string"
                  },
                  "limit": {
                    "description": "Page size, default 20, max 100",
                    "type": "number"
                  },
                  "min_confidence": {
                    "description": "Minimum AI confidence score 0-100",
                    "type": "number"
                  },
                  "offset": {
                    "description": "Pagination offset, default 0",
                    "type": "number"
                  },
                  "severity": {
                    "description": "Minimum severity: critical | high | medium | low | info",
                    "type": "string"
                  },
                  "since": {
                    "description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z",
                    "type": "string"
                  },
                  "tag": {
                    "description": "Tag keyword filter, e.g. ransomware, cobalt-strike, apt",
                    "type": "string"
                  },
                  "tlp": {
                    "description": "TLP classification: WHITE | GREEN | AMBER | RED",
                    "type": "string"
                  },
                  "type": {
                    "description": "IOC type: ip | domain | url | md5 | sha1 | sha256 | cve",
                    "type": "string"
                  }
                },
                "type": "object"
              },
              "type": {
                "const": "http",
                "type": "string"
              }
            },
            "required": [
              "type",
              "method"
            ],
            "type": "object"
          },
          "output": {
            "properties": {
              "example": {
                "type": "object"
              },
              "type": {
                "type": "string"
              }
            },
            "required": [
              "type"
            ],
            "type": "object"
          }
        },
        "required": [
          "input"
        ],
        "type": "object"
      }
    }
  },
  "tags": [
    "bazaar"
  ],
  "sourceHost": "telesint-api.onrender.com",
  "lastUpdated": "2026-09-14T19:54:36.619Z",
  "quality": {
    "calls30d": 8,
    "uniquePayers30d": 7,
    "lastCalledAt": "2026-09-14T19:54:36.24Z"
  },
  "liveness": {},
  "verified": false,
  "featured": false,
  "provider": {
    "host": "telesint-api.onrender.com",
    "manifest_name": "telesint-api.onrender.com",
    "source": "cdp-mirror",
    "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources",
    "submitted_at": "2026-09-18T22:00:31.484Z"
  }
}