# RocketCore Intel — SSH Username Spray Intelligence

> RocketCore Intel — SSH Username Spray Intelligence is a paid API for AI agents from intel.rocket-core.com, paid per call via x402, $0.005/call, status down (last checked 2026-10-12).

Returns aggregated, sanitized intelligence on the most commonly attempted SSH login usernames observed across a honeypot fleet, covering a specified time window.

## Facts

- Endpoint: GET https://intel.rocket-core.com/v1/cyber/ssh-username-spray?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: down
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/rocketcore-intel-ssh-username-spray-intelligence-5e4b8b1e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_b9hED_3yWCNwnyShVF-f0

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability rocketcore-intel-ssh-username-spray-intelligence-5e4b8b1e
```

Example prompt: Pull the latest SSH username spray intelligence from RocketCore's honeypot fleet for the past 7 days — I want to see which usernames are being hit hardest so I can tighten up my SSH detection rules.

## When to prefer this

Choose this endpoint when you need current, honeypot-derived, privacy-safe SSH spray username data with volume statistics and aggregation metadata. It is particularly well-suited for feeding SIEM rules, intrusion detection systems, or threat intelligence reports with real-world attack signal. Prefer it over static blocklists or CVE feeds when you need live, frequency-ranked SSH attack username intelligence with provenance and methodology transparency.

## Known failure modes

- Payment not accepted or insufficient USDC balance — 402 response with payment requirements
- Invalid window parameter value — schema validation error
- No data available for the requested window — may return empty usernames array
- Rate limiting or quota exceeded — HTTP 429
- Service unavailable if honeypot fleet data pipeline is delayed — may return stale or no results

## How this service works

x402 pay-per-request AI-commerce API on Base mainnet (USDC). Serves sanitized, aggregated intelligence products. Discovery via /catalog and /.well-known/x402.

## Output

A JSON object listing the top SSH usernames observed in spray attacks across the RocketCore honeypot fleet during the requested window. Each username entry includes attack volume, number of distinct spray buckets, an estimated distinct source count, and share of total attack volume. The response also includes metadata: observation start/end timestamps, dataset and sanitizer version, methodology description, privacy threshold (k_min), suppression count (entries withheld for privacy), freshness indicator, and limitations disclaimer.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "ref": {
       "enum": [
        "x402scan",
        "agentic-market",
        "pay-sh",
        "ampersend",
        "x402-list",
        "signal402",
        "x402-slack",
        "x402-discord",
        "gitlab",
        "mcp",
        "x",
        "linkedin",
        "hackernews",
        "dev",
        "reddit",
        "poncho",
        "agentcash",
        "base-discord"
       ],
       "type": "string",
       "description": "Optional allowlisted referral source (attribution only)."
      },
      "window": {
       "enum": [
        "24h",
        "7d",
        "30d"
       ],
       "type": "string",
       "default": "24h",
       "description": "Aggregation window."
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "required": [
      "product",
      "window",
      "generated_at",
      "source",
      "k_min",
      "total_usernames_observed",
      "total_attacks",
      "usernames",
      "dataset_version",
      "freshness",
      "sanitizer_version",
      "schema_version",
      "methodology",
      "privacy_threshold",
      "suppression_count",
      "limitations",
      "observation_start",
      "observation_end"
     ],
     "properties": {
      "k_min": {
       "type": "integer",
       "minimum": 1
      },
      "source": {
       "type": "string"
      },
      "window": {
       "enum": [
        "24h",
        "7d",
        "30d"
       ],
       "type": "string"
      },
      "product": {
       "type": "string"
      },
      "freshness": {
       "type": "string"
      },
      "usernames": {
       "type": "array",
       "items": {
        "type": "object",
        "required": [
         "username",
         "spray_buckets",
         "attack_vol
… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "source": "RocketCore honeypot fleet (sanitized, k>=5 aggregated)",
  "product": "ssh-username-spray",
  "freshness": "see response"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/rocketcore-intel-ssh-username-spray-intelligence-5e4b8b1e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rocket-core.com](https://www.zero.xyz/host/intel.rocket-core.com/llms.txt)