# TeleSint IOC Feed

> TeleSint IOC Feed is a paid API for AI agents from telesint-api.onrender.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-15).

Retrieves indicators of compromise (IOCs) sourced from Telegram cyber threat intelligence channels, with filtering by type, severity, confidence, TLP, tags, and time window.

## Facts

- Endpoint: GET https://telesint-api.onrender.com/ioc
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/telesint-api-onrender-com-c4e87506
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_za6OxxkY-QhiyVPYLAt1w

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability telesint-api-onrender-com-c4e87506
```

Example prompt: Pull all high-severity IP and domain IOCs from the TeleSint Telegram CTI feed posted since yesterday, with at least 70% confidence, TLP:WHITE only — give me up to 50 results.

## When to prefer this

Use this endpoint when you need structured, curated IOC data specifically sourced from Telegram-based CTI communities, especially when you want to filter by indicator type (IP, domain, URL, hash, CVE), confidence threshold, TLP level, or specific Telegram channels. Prefer this over generic threat intel APIs when Telegram OSINT coverage is important or when you need TTP context alongside IOCs.

## Known failure modes

- Invalid 'type' enum value returns 400 or empty results
- 'since' timestamp in unsupported format causes parse error
- No matching results for highly restrictive filter combination returns empty items[]
- Payment failure (x402) blocks access if USDC not provided
- Rate limiting or server cold-start on Render.com may cause timeout
- Unknown channel name silently returns no results

## How this service works

IOC feed from Telegram CTI channels. Filters: type(ip|domain|url|hash|cve), severity, min_confidence, since, tlp, tag, channel, limit, offset. Returns items[] with iocs[], ttps[], confidence, severity, tlp, tags[].

## Output

Returns a paginated list of feed items, each containing one or more IOCs (IPs, domains, URLs, hashes, or CVEs), associated TTPs, confidence score, severity rating, TLP classification, and tags sourced from Telegram CTI channels.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {}
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "tag": {
       "type": "string",
       "description": "Tag keyword filter, e.g. ransomware, cobalt-strike, apt"
      },
      "tlp": {
       "type": "string",
       "description": "TLP classification: WHITE | GREEN | AMBER | RED"
      },
      "type": {
       "type": "string",
       "description": "IOC type: ip | domain | url | md5 | sha1 | sha256 | cve"
      },
      "limit": {
       "type": "number",
       "description": "Page size, default 20, max 100"
      },
      "since": {
       "type": "string",
       "description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
      },
      "offset": {
       "type": "number",
       "description": "Pagination offset, default 0"
      },
      "channel": {
       "type": "string",
       "description": "Partial match on source Telegram channel name"
      },
      "severity": {
       "type": "string",
       "description": "Minimum severity: critical | high | medium | low | info"
      },
      "min_confidence": {
       "type": "number",
       "description": "Minimum AI confidence score 0-100"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "items": [
   {
    "id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
    "ts": "2026-05-27T14:32:00Z",
    "tlp": "WHITE",
    "iocs": [
     {
      "type": "url",
      "value": "https://github[.]com/Nightmare-Eclipse/MiniPlasma",
      "context": "Exploit repository"
     },
     {
      "type": "ip",
      "value": "185.220[.]101.47",
      "context": "C2 callback address"
     },
     {
      "type": "sha256",
      "value": "e3b0c44298fc1c149afb4c8996fb924...",
      "context": "Dropper hash"
     }
    ],
    "tags": [
     "zero-day",
     "windows",
     "government",
     "exploit"
    ],
    "ttps": [
     {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
     },
     {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
     }
    ],
    "channel": "https://t[.]me/vxunderground",
    "summary": "Windows zero-day exploit released by Nightmare Eclipse threat group targeting government networks",
    "category": "ioc",
    "severity": "high",
    "confidence": 80
   }
  ],
  "limit": 20,
  "total": 42,
  "offset": 0,
  "source": "TeleSint",
  "endpoint": "ioc"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/telesint-api-onrender-com-c4e87506/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from telesint-api.onrender.com](https://www.zero.xyz/host/telesint-api.onrender.com/llms.txt)