# TeleSint Malware Family Intelligence

> TeleSint Malware Family Intelligence is a paid API for AI agents from telesint-api.onrender.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Returns AI-enriched malware family intelligence sourced from public Telegram CTI channels, with IOCs, MITRE ATT&CK TTPs, confidence scores, and TLP classifications

## Facts

- Endpoint: GET https://telesint-api.onrender.com/malware
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/telesint-malware-family-intelligence-2f785720
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_9t_B-jviyByy7JuB4Eu23

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability telesint-malware-family-intelligence-2f785720
```

Example prompt: Pull the latest high-severity stealer malware intelligence from TeleSint — show me up to 20 records with at least 80 confidence, tagged as stealer type, and include any T1555 technique matches from the past week.

## When to prefer this

Choose this endpoint when you need structured, AI-enriched malware family intelligence with MITRE ATT&CK tagging sourced from active Telegram CTI communities, especially when you want to filter by malware type (stealer, RAT, botnet, etc.), TTP technique, severity, or confidence threshold. Prefer this over generic threat feeds when you need fresh intelligence from underground and grey-hat Telegram channels with DeepSeek-enriched context, IOC extraction, and pay-per-call micropayment access without API key management.

## Known failure modes

- Payment not included or invalid USDC micropayment on Base — returns 402 Payment Required
- Invalid tag enum value (not one of stealer/loader/rat/backdoor/botnet/worm/dropper/rootkit) — returns 400 Bad Request
- min_confidence outside 0-100 range — returns 400 validation error
- Invalid since timestamp format (not ISO 8601) — returns 400 Bad Request
- limit exceeds 100 — returns 400 Bad Request
- No matching records for given filters — returns empty items array with total 0
- Service temporarily unavailable on Render free tier — returns 503 or timeout

## How this service works

Malware family intelligence from Telegram: new sample drops, behavior analysis, loader/stealer/RAT/backdoor writeups. Filters: severity, min_confidence, since, tag(stealer|loader|rat|backdoor), limit, offset.

## Output

A JSON object containing a paginated list of malware intelligence records, each with a unique ID, timestamp, TLP classification (WHITE/GREEN/AMBER/RED), IOCs (SHA256 hashes, domains, IPs), MITRE ATT&CK TTP mappings with tactic and technique names, malware tags (family name, type, distribution model), AI-generated summary, severity rating, confidence score (0-100), source Telegram channel URL, and endpoint/category metadata. Includes total count, limit, and offset for pagination.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "tag": {
       "type": "string",
       "description": "Malware type tag: stealer | loader | rat | backdoor | botnet | worm | dropper | rootkit"
      },
      "ttp": {
       "type": "string",
       "description": "MITRE ATT&CK technique ID prefix, e.g. T1059, T1071"
      },
      "limit": {
       "type": "number",
       "description": "Page size, default 20, max 100"
      },
      "since": {
       "type": "string",
       "description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
      },
      "offset": {
       "type": "number",
       "description": "Pagination offset, default 0"
      },
      "severity": {
       "type": "string",
       "description": "Minimum severity: critical | high | medium | low | info"
      },
      "min_confidence": {
       "type": "number",
       "description": "Minimum AI confidence score 0-100"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "items": [
   {
    "id": "m1a2l3w4-a5r6-7890-abcd-malware78901",
    "ts": "2026-05-27T11:00:00Z",
    "tlp": "WHITE",
    "iocs": [
     {
      "type": "sha256",
      "value": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
      "context": "Lumma Stealer sample"
     },
     {
      "type": "domain",
      "value": "lumma-panel[.]xyz",
      "context": "C2 panel domain"
     }
    ],
    "tags": [
     "lumma",
     "stealer",
     "maas",
     "infostealer",
     "chrome"
    ],
    "ttps": [
     {
      "id": "T1555.003",
      "name": "Credentials from Web Browsers",
      "tactic": "Credential Access"
     },
     {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
     }
    ],
    "channel": "https://t[.]me/vxunderground",
    "summary": "New Lumma Stealer v4.1 released with browser cookie bypass targeting Chrome 124+ — sold as MaaS on underground forums",
    "category": "malware",
    "severity": "high",
    "confidence": 85
   }
  ],
  "limit": 20,
  "total": 19,
  "offset": 0,
  "source": "TeleSint",
  "endpoint": "malware"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/telesint-malware-family-intelligence-2f785720/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from telesint-api.onrender.com](https://www.zero.xyz/host/telesint-api.onrender.com/llms.txt)