# RadhikaChain Threat Intelligence Feed — /federacion/amenazas

> RadhikaChain Threat Intelligence Feed — /federacion/amenazas is a paid API for AI agents from x402.radhikatmosphere.com, paid per call via x402, $1.0296/call, status unknown (last checked 2026-09-15).

Returns a live threat intelligence feed of hostile IPs and scanning activity observed across blockchain network nodes via XDP/eBPF sensors

## Facts

- Endpoint: GET https://x402.radhikatmosphere.com/federacion/amenazas
- Price: $1.0296/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/radhikachain-threat-intelligence-feed-federacion-amenazas-ffdb924d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_aft6TxWX7uhcKNRRftDnv

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability radhikachain-threat-intelligence-feed-federacion-amenazas-ffdb924d
```

Example prompt: Pull the latest threat feed from RadhikaChain's federation sensors — I want to see which IPs are actively scanning blockchain nodes right now, including their port targets and classification.

## When to prefer this

Choose this endpoint when you need real-time, sensor-derived threat intelligence specifically targeting blockchain and crypto network infrastructure (devp2p, Ethereum RPC ports). It is pay-per-call with no subscription required, making it ideal for on-demand threat checks. Prefer it over generic threat feeds when your concern is Web3 node security, hostile IP scanning of blockchain ports, or building blocklists for crypto infrastructure defense.

## Known failure modes

- Payment not provided or invalid x402 USDC payment — returns 402 Payment Required
- Malformed request headers — returns 400 Bad Request
- Temporary sensor data unavailability — returns 503 or empty threat array
- Network timeout if sensor aggregation is delayed — returns 504 or slow response
- Stale data if sensors have not recently synced — timestamps may be outdated

## How this service works

Telemetria de cadena, inteligencia de defensa y computo verificable (Halo2, Nova, Plonky3). Pago por peticion en USDC nativo en Base (eip155:8453) mediante x402 v2 scheme exact; sin cuenta ni suscripcion. Catalogo canonico: GET /.well-known/x402.

## Output

A JSON object containing a total threat count, a source description (XDP/eBPF sensors), and an array of threat entries. Each entry includes the attacker IP, TTL, list of probed ports, probe count, nodes where it was observed, TCP flags used, probable OS, first and last seen timestamps, and a threat classification string (e.g. 'persistent probe', 'port sweep').

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "properties": {
  "input": {
   "type": "object",
   "properties": {
    "body": {
     "type": "object",
     "additionalProperties": true
    },
    "queryParams": {
     "type": "object",
     "additionalProperties": true
    }
   }
  },
  "output": {
   "type": "object",
   "properties": {
    "example": {
     "type": "object",
     "additionalProperties": true
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "nota": "'visto_en' indica en cuantos nodos aparecio: mas nodos significa un escaneo mas amplio",
  "total": 2091,
  "fuente": "sensores XDP/eBPF en los nodos de la red",
  "amenazas": [
   {
    "ip": "169.188.233.172",
    "ttl": 45,
    "puertos": [
     8545
    ],
    "sondeos": 30242233902,
    "visto_en": [
     "seed"
    ],
    "flags_tcp": [
     2,
     16,
     24,
     17,
     4
    ],
    "so_probable": "linux/unix",
    "primer_visto": 7391931344,
    "ultimo_visto": 122915823205836,
    "clasificacion": "sondeo insistente"
   },
   {
    "ip": "64.248.200.172",
    "ttl": 40,
    "puertos": [
     8151,
     8126,
     28334,
     8413,
     8402,
     3000,
     28332,
     5000,
     8414,
     8332,
     28335,
     28333
    ],
    "sondeos": 27119417444,
    "visto_en": [
     "seed"
    ],
    "flags_tcp": [
     24,
     16,
     2,
     17,
     4,
     18,
     25
    ],
    "so_probable": "linux/unix",
    "primer_visto": 1103534350967449,
    "ultimo_visto": 1550758766647374,
    "clasificacion": "barrido de puertos"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/radhikachain-threat-intelligence-feed-federacion-amenazas-ffdb924d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.radhikatmosphere.com](https://www.zero.xyz/host/x402.radhikatmosphere.com/llms.txt)