# RadhikaChain — Live Threat Feed (amenazas/vivas)

> RadhikaChain — Live Threat Feed (amenazas/vivas) is a paid API for AI agents from x402.radhikachain.xyz, paid per call via x402, $4.29/call, status unknown (last checked 2026-09-15).

Returns a real-time feed of active network threats detected via eBPF/XDP sensors, including per-IP port scans, TCP flag patterns, TTL, OS fingerprints, and threat classifications — actionable for firewall ingestion.

## Facts

- Endpoint: GET https://x402.radhikachain.xyz/amenazas/vivas
- Price: $4.29/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/radhikachain-live-threat-feed-amenazas-vivas-12c3a8dc
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap__NTdhb4eEnUGIqN0baJf7

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability radhikachain-live-threat-feed-amenazas-vivas-12c3a8dc
```

Example prompt: Pull the live threat feed from RadhikaChain right now — I want to see which IPs are actively port-scanning or probing, along with their TCP flags, TTL, and OS guesses so I can push new firewall block rules.

## When to prefer this

Choose this endpoint when you need per-IP, per-port, TCP-flag-level threat intelligence suitable for direct firewall ingestion, rather than aggregated traffic counters. It is particularly valuable for blockchain infrastructure operators who need real-time eBPF-sourced sensor data (not iptables aggregates) and want actionable records with OS fingerprinting and precise timestamps. Prefer this over generic threat intel feeds when you need granular packet-level metadata and are already operating in the x402/Base USDC micropayment ecosystem.

## Known failure modes

- Payment not received or invalid x402 USDC payment header — returns 402 Payment Required
- Sensor data temporarily unavailable — may return empty threat array or 503
- Stale data if eBPF pipeline is lagging — timestamps should be checked
- Invalid or expired USDC payment on Base chain — transaction rejected
- Rate limiting if payment is replayed or double-spent

## How this service works

Telemetria de cadena, inteligencia de defensa y computo verificable (Halo2, Nova, Plonky3). Pago por peticion en USDC nativo en Base (eip155:8453) mediante x402 v2 scheme exact; sin cuenta ni suscripcion. Catalogo canonico: GET /.well-known/x402.

## Output

A JSON object containing an array of active threat entries, each with the attacker IP, TTL, list of probed ports, TCP flag codes, probable OS, first/last seen timestamps (microseconds), probe count, distinct port count, and threat classification (e.g. 'barrido de puertos' / port sweep, 'sondeo insistente' / persistent probe). Also includes aggregate stats: total distinct IPs observed and total event count. Data sourced from live eBPF/XDP NIC sensors, not aggregated iptables counters.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "properties": {
  "input": {
   "type": "object",
   "properties": {
    "body": {
     "type": "object",
     "additionalProperties": true
    },
    "queryParams": {
     "type": "object",
     "additionalProperties": true
    }
   }
  },
  "output": {
   "type": "object",
   "properties": {
    "example": {
     "type": "object",
     "additionalProperties": true
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "fuente": "sensor XDP en la NIC (eBPF), no contadores de iptables",
  "amenazas": [
   {
    "ip": "8.103.58.198",
    "ttl": 45,
    "puertos": [
     22,
     8402,
     8151,
     8332,
     5000,
     3000,
     8788,
     8413,
     9103
    ],
    "sondeos": 665179,
    "flags_tcp": [
     16,
     2,
     24,
     17,
     4,
     20,
     25
    ],
    "so_probable": "linux/unix",
    "primer_visto": 1512360412807002,
    "ultimo_visto": 2360929756865408,
    "clasificacion": "barrido de puertos",
    "puertos_distintos": 9
   },
   {
    "ip": "3.38.236.54",
    "ttl": 47,
    "puertos": [
     3000
    ],
    "sondeos": 10156,
    "flags_tcp": [
     2,
     4,
     16,
     24,
     17
    ],
    "so_probable": "linux/unix",
    "primer_visto": 2078920099453734,
    "ultimo_visto": 2186077586730334,
    "clasificacion": "sondeo insistente",
    "puertos_distintos": 1
   }
  ],
  "diferencia": "cada entrada trae IP, puertos, flags TCP y TTL: accionable en un firewall. Los contadores agregados no.",
  "ips_distintas": 1819,
  "eventos_totales": 811757
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/radhikachain-live-threat-feed-amenazas-vivas-12c3a8dc/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.radhikachain.xyz](https://www.zero.xyz/host/x402.radhikachain.xyz/llms.txt)