Dark web intelligence from Telegram: marketplace listings, forum chatter, access broker po

[
  {
    "scheme": "exact",
    "network": "eip155:8453",
    "payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "amount": "30000",
    "maxTimeoutSeconds": 300
  }
]

{
  "bazaar": {
    "info": {
      "input": {
        "method": "GET",
        "queryParams": {
          "limit": 20,
          "min_confidence": 60,
          "offset": 0,
          "sector": "finance",
          "severity": "high",
          "since": "2026-05-01T00:00:00Z",
          "tag": "access-broker"
        },
        "type": "http"
      },
      "output": {
        "example": {
          "endpoint": "darkweb",
          "items": [
            {
              "category": "darkweb",
              "channel": "https://t[.]me/darkwebinformer",
              "confidence": 78,
              "id": "d1a2r3k4-w5e6-7890-abcd-darkweb78901",
              "iocs": [
                {
                  "context": "Underground forum listing",
                  "type": "url",
                  "value": "https://exploit[.]in/threads/healthcare-access-12345"
                }
              ],
              "severity": "critical",
              "summary": "Access broker selling domain admin access to US healthcare network (5,000 employees) — asking $15,000 on exploit.in forum",
              "tags": [
                "access-broker",
                "healthcare",
                "initial-access",
                "domain-admin",
                "exploit-in"
              ],
              "target": {
                "countries": [
                  "US"
                ],
                "organizations": [],
                "sectors": [
                  "healthcare"
                ]
              },
              "tlp": "WHITE",
              "ts": "2026-05-27T06:45:00Z",
              "ttps": [
                {
                  "id": "T1078",
                  "name": "Valid Accounts",
                  "tactic": "Initial Access"
                }
              ]
            }
          ],
          "limit": 20,
          "offset": 0,
          "source": "TeleSint",
          "total": 14
        },
        "type": "json"
      }
    },
    "schema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "properties": {
        "input": {
          "additionalProperties": false,
          "properties": {
            "method": {
              "enum": [
                "GET"
              ],
              "type": "string"
            },
            "queryParams": {
              "properties": {
                "country": {
                  "description": "Targeted country keyword, e.g. us | uk | de | fr",
                  "type": "string"
                },
                "limit": {
                  "description": "Page size, default 20, max 100",
                  "type": "number"
                },
                "min_confidence": {
                  "description": "Minimum AI confidence score 0-100",
                  "type": "number"
                },
                "offset": {
                  "description": "Pagination offset, default 0",
                  "type": "number"
                },
                "organization": {
                  "description": "Targeted organization name partial match",
                  "type": "string"
                },
                "sector": {
                  "description": "Targeted sector: finance | healthcare | government | energy | retail",
                  "type": "string"
                },
                "severity": {
                  "description": "Minimum severity: critical | high | medium | low | info",
                  "type": "string"
                },
                "since": {
                  "description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z",
                  "type": "string"
                },
                "tag": {
                  "description": "Tag keyword: access-broker | credential-shop | combo-list | carding | forum | marketplace",
                  "type": "string"
                }
              },
              "type": "object"
            },
            "type": {
              "const": "http",
              "type": "string"
            }
          },
          "required": [
            "type",
            "method"
          ],
          "type": "object"
        },
        "output": {
          "properties": {
            "example": {
              "type": "object"
            },
            "type": {
              "type": "string"
            }
          },
          "required": [
            "type"
          ],
          "type": "object"
        }
      },
      "required": [
        "input"
      ],
      "type": "object"
    }
  }
}

curl "https://telesint-api.onrender.com/darkweb"
# -> 402 Payment Required, accepts[] lists how to pay
# retry with a PAYMENT-SIGNATURE (or PAYMENT header) once paid

const res = await fetch("https://telesint-api.onrender.com/darkweb");
if (res.status === 402) {
  const { accepts } = await res.json();
  // pay one of accepts[] via an x402 client, then retry with the payment header
}

import httpx
res = httpx.get("https://telesint-api.onrender.com/darkweb")
if res.status_code == 402:
    accepts = res.json()["accepts"]
    # pay one of accepts[] via an x402 client, then retry with the payment header