# TeleSint C2 Infrastructure Feed

> TeleSint C2 Infrastructure Feed is a paid API for AI agents from telesint-api.onrender.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Returns active C2 (command-and-control) infrastructure intelligence — IPs, domains, MITRE TTPs, and confidence scores — sourced from Telegram threat intelligence channels, filterable by C2 framework, severity, and confidence.

## Facts

- Endpoint: GET https://telesint-api.onrender.com/c2
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/telesint-api-onrender-com-24f849c4
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_y2gMBSVMkSpjDcnK57U1l

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability telesint-api-onrender-com-24f849c4
```

Example prompt: Pull the latest high-severity Cobalt Strike C2 infrastructure from TeleSint — filter for confidence above 80 and show me the IPs, domains, and associated MITRE TTPs from the past week.

## When to prefer this

Use this endpoint when you need C2 infrastructure indicators specifically (IPs/domains used for command-and-control), especially when you need to filter by specific C2 frameworks like Cobalt Strike or Sliver. Prefer this over the generic IOC feed when your use case is network-level C2 detection or blocking, or when you need MITRE TTP context linked directly to active C2 infrastructure sourced from Telegram threat intelligence communities.

## Known failure modes

- Invalid framework enum value returns 400 bad request
- No results for overly restrictive filter combination returns empty items array
- Service unavailable on Render cold start returns 503
- Invalid since timestamp format returns 400 parse error
- Offset exceeding result set returns empty items array

## How this service works

C2 infrastructure from Telegram. Filters: framework(cobalt_strike|sliver|havoc|brute_ratel), severity, min_confidence, since, tag, limit, offset. Returns items[] with C2 IPs/domains, MITRE TTPs, confidence.

## Output

Returns an array of C2 infrastructure items, each containing C2 IPs and/or domains, associated MITRE ATT&CK TTPs, a confidence score, framework identification (e.g. cobalt_strike, sliver), severity rating, and relevant tags sourced from Telegram CTI channels.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {}
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "tag": {
       "type": "string",
       "description": "Tag keyword filter, e.g. cobalt-strike, sliver, c2"
      },
      "limit": {
       "type": "number",
       "description": "Page size, default 20, max 100"
      },
      "since": {
       "type": "string",
       "description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
      },
      "offset": {
       "type": "number",
       "description": "Pagination offset, default 0"
      },
      "severity": {
       "type": "string",
       "description": "Minimum severity: critical | high | medium | low | info"
      },
      "framework": {
       "type": "string",
       "description": "C2 framework: cobalt_strike | sliver | havoc | brute_ratel | metasploit"
      },
      "min_confidence": {
       "type": "number",
       "description": "Minimum AI confidence score 0-100"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "items": [
   {
    "id": "c2a1b2c3-d4e5-f6a7-b8c9-d0e1f2a3b4c5",
    "ts": "2026-05-27T09:15:00Z",
    "tlp": "WHITE",
    "iocs": [
     {
      "type": "ip",
      "value": "91.92[.]109.83",
      "context": "Cobalt Strike team server"
     },
     {
      "type": "domain",
      "value": "windowsupdate[.]xyz",
      "context": "Malleable C2 domain"
     },
     {
      "type": "url",
      "value": "https://91.92[.]109.83/updates",
      "context": "Beacon callback URL"
     }
    ],
    "tags": [
     "cobalt-strike",
     "malleable-c2",
     "windows-masquerade"
    ],
    "ttps": [
     {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
     },
     {
      "id": "T1573.001",
      "name": "Encrypted Channel: Symmetric Cryptography",
      "tactic": "Command and Control"
     }
    ],
    "channel": "https://t[.]me/malwrhunterteam",
    "summary": "Cobalt Strike beacon detected with malleable C2 profile mimicking Microsoft update traffic",
    "category": "c2",
    "severity": "critical",
    "confidence": 90
   }
  ],
  "limit": 20,
  "total": 8,
  "offset": 0,
  "source": "TeleSint",
  "endpoint": "c2"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/telesint-api-onrender-com-24f849c4/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from telesint-api.onrender.com](https://www.zero.xyz/host/telesint-api.onrender.com/llms.txt)