# RocketCore Intel — SSH Attack Trends

> RocketCore Intel — SSH Attack Trends is a paid API for AI agents from intel.rocket-core.com, paid per call via x402, $0.005/call, status down (last checked 2026-10-12).

Returns aggregated, privacy-sanitized SSH brute-force attack trend data from a honeypot fleet, bucketed by country and time window.

## Facts

- Endpoint: GET https://intel.rocket-core.com/v1/cyber/ssh-attack-trends?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: down
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/rocketcore-intel-ssh-attack-trends-6971d8b5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_RRs31zqQlI0MYRFMo-lJi

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability rocketcore-intel-ssh-attack-trends-6971d8b5
```

Example prompt: Pull the latest SSH attack trend data for the past 7 days from RocketCore Intel — I want to see which countries are most active and what usernames are being targeted.

## When to prefer this

Choose this endpoint when you need current, privacy-safe, aggregated SSH brute-force attack intelligence sourced from a live honeypot fleet, particularly when you want country-level breakdowns and username trends without raw IP-level data. Prefer it over generic threat feeds when you want pay-per-use pricing (no subscription), on-chain USDC micropayments via x402, and a machine-readable structured format suitable for agent pipelines. It is best suited for SOC automation, threat dashboard enrichment, and firewall policy decisions.

## Known failure modes

- Payment not received or insufficient USDC balance — returns HTTP 402 with payment instructions
- Invalid window parameter value — returns validation error
- Data suppression: buckets with fewer than k_min=5 distinct sources are suppressed and counted in suppression_count
- Stale data if honeypot fleet has collection gaps — check freshness field in response
- Rate limiting if too many requests are made without payment

## How this service works

x402 pay-per-request AI-commerce API on Base mainnet (USDC). Serves sanitized, aggregated intelligence products. Discovery via /catalog and /.well-known/x402.

## Output

A JSON object containing time-bucketed SSH attack statistics sourced from RocketCore's sanitized honeypot fleet. Each bucket includes: country (ISO code), granularity (hour or day), attack count, number of distinct sources (minimum 5 for privacy), and coarse top usernames attempted. Also includes metadata: product name, aggregation window, generation timestamp, dataset version, freshness, sanitizer version, schema version, methodology, privacy threshold (k_min), suppression count, and observation start/end timestamps.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "ref": {
       "enum": [
        "x402scan",
        "agentic-market",
        "pay-sh",
        "ampersend",
        "x402-list",
        "signal402",
        "x402-slack",
        "x402-discord",
        "gitlab",
        "mcp",
        "x",
        "linkedin",
        "hackernews",
        "dev",
        "reddit",
        "poncho"
       ],
       "type": "string",
       "description": "Optional allowlisted referral source (attribution only; does not change the canonical payable resource or the intelligence returned)."
      },
      "window": {
       "enum": [
        "24h",
        "7d",
        "30d"
       ],
       "type": "string",
       "default": "24h",
       "description": "Aggregation window."
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "required": [
      "product",
      "window",
      "generated_at",
      "source",
      "k_min",
      "total_attacks",
      "distinct_sources",
      "buckets",
      "dataset_version",
      "freshness",
      "sanitizer_version",
      "schema_version",
      "methodology",
      "privacy_threshold",
      "suppression_count",
      "limitations",
      "observation_start",
      "observation_end"
     ],
     "properties": {
      "k_min": {
       "type": "integer",
       "minimum": 1
      },
      "source": {
       "type": "string"
      },
      "window": {
       "enum": [
        "24h",
        "7d",
        "30d"
       ],
       "type": "string"
      },
      "buckets": {
       "type": "array",
       "items": {
        "type": "object",
        "required": [
         "bucket_start",
         "granularity",
         "country",
         "attack_count",
         "distinct_sources",
         "top_usernames"
     
… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "source": "RocketCore honeypot fleet (sanitized, k>=5 aggregated)",
  "product": "ssh-attack-trends",
  "freshness": "see response"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/rocketcore-intel-ssh-attack-trends-6971d8b5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rocket-core.com](https://www.zero.xyz/host/intel.rocket-core.com/llms.txt)