# TeleSint Dark Web Monitoring Feed

> TeleSint Dark Web Monitoring Feed is a paid API for AI agents from telesint-api.onrender.com, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-15).

Retrieves AI-enriched dark web threat intelligence from Telegram CTI channels, covering access brokers, credential shops, combo lists, carding activity, underground forums, and marketplaces with MITRE ATT&CK tagging.

## Facts

- Endpoint: GET https://telesint-api.onrender.com/darkweb
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/telesint-dark-web-monitoring-feed-f37671ec
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_lr-TmFu68sLHfH0duxjIK

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability telesint-dark-web-monitoring-feed-f37671ec
```

Example prompt: Pull the latest critical-severity dark web listings from TeleSint targeting the healthcare sector in the US — show up to 20 results since May 1 2026, only access-broker tags, with a minimum confidence score of 70.

## When to prefer this

Choose this endpoint when you need dark web-specific intelligence — access broker listings, credential shops, carding activity, or underground forum posts — with structured MITRE ATT&CK tagging, TLP labels, and AI-enriched summaries sourced from Telegram CTI channels. Prefer this over general IOC or breach endpoints when your focus is on pre-compromise marketplace activity and initial-access sales rather than post-breach indicators or CVE tracking.

## Known failure modes

- Payment not made or insufficient USDC — 402 Payment Required response
- Invalid enum value for tag, sector, or severity — 400 Bad Request
- Invalid ISO 8601 format for since parameter — 400 Bad Request
- min_confidence outside 0-100 range — 400 Bad Request
- No matching records for given filters — empty items array with total:0
- Service unavailable on Render free tier cold start — timeout or 503
- limit exceeds max of 100 — potential 400 or silently capped

## How this service works

Dark web intelligence from Telegram: marketplace listings, forum chatter, access broker posts, credential shops, Tor site activity. Filters: severity, min_confidence, since, tag, sector, country, organization, limit, offset.

## Output

Returns a paginated JSON array of dark web intelligence records, each containing a unique ID, timestamp, TLP classification, IOCs (e.g. underground forum URLs), tags (activity type and sector), MITRE ATT&CK TTPs, target sectors/countries/organizations, Telegram channel source, plain-language summary, severity level, and AI confidence score (0-100). Also includes total count, offset, and limit for pagination.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "tag": {
       "type": "string",
       "description": "Tag keyword: access-broker | credential-shop | combo-list | carding | forum | marketplace"
      },
      "limit": {
       "type": "number",
       "description": "Page size, default 20, max 100"
      },
      "since": {
       "type": "string",
       "description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
      },
      "offset": {
       "type": "number",
       "description": "Pagination offset, default 0"
      },
      "sector": {
       "type": "string",
       "description": "Targeted sector: finance | healthcare | government | energy | retail"
      },
      "country": {
       "type": "string",
       "description": "Targeted country keyword, e.g. us | uk | de | fr"
      },
      "severity": {
       "type": "string",
       "description": "Minimum severity: critical | high | medium | low | info"
      },
      "organization": {
       "type": "string",
       "description": "Targeted organization name partial match"
      },
      "min_confidence": {
       "type": "number",
       "description": "Minimum AI confidence score 0-100"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "items": [
   {
    "id": "d1a2r3k4-w5e6-7890-abcd-darkweb78901",
    "ts": "2026-05-27T06:45:00Z",
    "tlp": "WHITE",
    "iocs": [
     {
      "type": "url",
      "value": "https://exploit[.]in/threads/healthcare-access-12345",
      "context": "Underground forum listing"
     }
    ],
    "tags": [
     "access-broker",
     "healthcare",
     "initial-access",
     "domain-admin",
     "exploit-in"
    ],
    "ttps": [
     {
      "id": "T1078",
      "name": "Valid Accounts",
      "tactic": "Initial Access"
     }
    ],
    "target": {
     "sectors": [
      "healthcare"
     ],
     "countries": [
      "US"
     ],
     "organizations": []
    },
    "channel": "https://t[.]me/darkwebinformer",
    "summary": "Access broker selling domain admin access to US healthcare network (5,000 employees) — asking $15,000 on exploit.in forum",
    "category": "darkweb",
    "severity": "critical",
    "confidence": 78
   }
  ],
  "limit": 20,
  "total": 14,
  "offset": 0,
  "source": "TeleSint",
  "endpoint": "darkweb"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/telesint-dark-web-monitoring-feed-f37671ec/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from telesint-api.onrender.com](https://www.zero.xyz/host/telesint-api.onrender.com/llms.txt)