# TeleSint Threat Actor Intelligence Feed

> TeleSint Threat Actor Intelligence Feed is a paid API for AI agents from telesint-api.onrender.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Returns structured threat actor profiles sourced from Telegram CTI channels, filterable by name, nation-state, motivation, TTP, and severity.

## Facts

- Endpoint: GET https://telesint-api.onrender.com/actor
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/telesint-api-onrender-com-dee7536e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_6bwkDPbfK9X4M44MYJ3CC

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability telesint-api-onrender-com-dee7536e
```

Example prompt: Pull me threat actor profiles from Telegram CTI for Russian nation-state groups motivated by espionage — give me the top 10 by severity so I can see their TTPs and which sectors they're targeting.

## When to prefer this

Use this endpoint when you need structured threat actor intelligence sourced specifically from Telegram CTI channels, especially when you need to filter by nation-state attribution (kp/ru/cn/ir), actor motivation, or specific TTPs. Prefer this over generic OSINT tools when you need Telegram-derived actor profiles with sector and country targeting data in a machine-readable format.

## Known failure modes

- No actors match the specified filters — returns empty items array
- Invalid nation_state enum value (e.g. not kp|ru|cn|ir) — likely 400 or empty result
- Invalid motivation value — likely 400 or ignored filter
- Payment not processed (x402 protocol failure) — 402 response
- Render cold-start latency if service is sleeping — slow initial response
- Rate limiting or quota exceeded for the $0.02/call pricing tier

## How this service works

Threat actor profiles from Telegram. Filters: name, nation_state(kp|ru|cn|ir), motivation(financial|espionage|hacktivism), ttp, severity, limit. Returns items[] with actor{}, ttps[], target{sectors,countries}.

## Output

Returns an array of items[], each containing an actor{} object with profile details, a ttps[] array of associated tactics/techniques/procedures, and a target{} object listing targeted sectors and countries.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {}
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "ttp": {
       "type": "string",
       "description": "MITRE ATT&CK technique ID prefix, e.g. T1059, T1566"
      },
      "name": {
       "type": "string",
       "description": "Actor name or alias partial match, e.g. lazarus, sandworm, apt28"
      },
      "limit": {
       "type": "number",
       "description": "Page size, default 20, max 100"
      },
      "offset": {
       "type": "number",
       "description": "Pagination offset, default 0"
      },
      "severity": {
       "type": "string",
       "description": "Minimum severity: critical | high | medium | low | info"
      },
      "motivation": {
       "type": "string",
       "description": "Actor motivation: financial | espionage | hacktivism | sabotage"
      },
      "nation_state": {
       "type": "string",
       "description": "Attributed country ISO code: kp | ru | cn | ir | us"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "items": [
   {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "ts": "2026-05-26T18:00:00Z",
    "tlp": "WHITE",
    "tags": [
     "lazarus",
     "apt38",
     "cryptocurrency",
     "spearphishing"
    ],
    "ttps": [
     {
      "id": "T1566.001",
      "name": "Spearphishing Attachment",
      "tactic": "Initial Access"
     },
     {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
     }
    ],
    "actor": {
     "name": "Lazarus Group",
     "motivation": "financial",
     "nation_state": "KP"
    },
    "target": {
     "sectors": [
      "finance",
      "cryptocurrency"
     ],
     "countries": [
      "KR",
      "US"
     ]
    },
    "channel": "https://t[.]me/ctinow",
    "summary": "Lazarus Group campaign targeting South Korean crypto exchanges with new spear-phishing lures",
    "category": "actor",
    "severity": "critical",
    "confidence": 85
   }
  ],
  "limit": 20,
  "total": 4,
  "offset": 0,
  "source": "TeleSint",
  "endpoint": "actor"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/telesint-api-onrender-com-dee7536e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from telesint-api.onrender.com](https://www.zero.xyz/host/telesint-api.onrender.com/llms.txt)