# Telesint Ransomware Activity Feed

> Telesint Ransomware Activity Feed is a paid API for AI agents from telesint-api.onrender.com, paid per call via x402, $0.04/call, status unknown (last checked 2026-09-15).

Returns ransomware group activity intelligence sourced from Telegram, including victim posts, leak site announcements, and extortion demands, with filtering by group, severity, sector, country, and confidence.

## Facts

- Endpoint: GET https://telesint-api.onrender.com/ransomware
- Price: $0.04/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/telesint-ransomware-activity-feed-9a675f11
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_jGFztsmnwqCKnBBdShmwC

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability telesint-ransomware-activity-feed-9a675f11
```

Example prompt: Pull the latest high-severity ransomware activity from Telesint for LockBit and BlackCat groups targeting the healthcare sector in the US since May 1st 2025, with a minimum confidence of 75, and give me the top 25 results.

## When to prefer this

Use this endpoint when you need Telegram-sourced ransomware threat intelligence specifically — victim announcements, leak posts, and extortion activity — filtered by specific threat actor groups like LockBit, BlackCat, Cl0p, or RansomHub. Prefer this over generic threat feeds when you need near-real-time ransomware group activity with AI-scored confidence, sector/country targeting context, and Telegram provenance.

## Known failure modes

- Invalid tag value returns 400 or empty results
- since parameter not in ISO 8601 format causes parse error
- min_confidence outside 0-100 range may return error or be ignored
- Render.com cold start may cause initial latency spike or timeout
- No matching results for filter combination returns empty array
- Payment not processed (x402 protocol failure) blocks access

## How this service works

Ransomware group activity from Telegram: victim posts, leak site announcements, extortion demands. Filters: severity, min_confidence, since, tag(lockbit|blackcat|cl0p|ransomhub), sector, country, limit, offset.

## Output

A paginated list of ransomware group activity records sourced from Telegram, including victim posts, leak site announcements, and extortion demands. Each record includes group tag, severity, AI confidence score, targeted organization/sector/country, and timestamps.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "tag": {
       "type": "string",
       "description": "Ransomware group tag, e.g. lockbit, blackcat, cl0p, ransomhub, play, akira"
      },
      "limit": {
       "type": "number",
       "description": "Page size, default 20, max 100"
      },
      "since": {
       "type": "string",
       "description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
      },
      "offset": {
       "type": "number",
       "description": "Pagination offset, default 0"
      },
      "sector": {
       "type": "string",
       "description": "Targeted sector: finance | healthcare | government | energy | retail"
      },
      "country": {
       "type": "string",
       "description": "Targeted country keyword, e.g. us | uk | de | fr"
      },
      "severity": {
       "type": "string",
       "description": "Minimum severity: critical | high | medium | low | info"
      },
      "organization": {
       "type": "string",
       "description": "Targeted organization name partial match"
      },
      "min_confidence": {
       "type": "number",
       "description": "Minimum AI confidence score 0-100"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "items": [
   {
    "id": "r1a2n3s4-o5m6-7890-abcd-ransom789012",
    "ts": "2026-05-27T08:30:00Z",
    "tlp": "WHITE",
    "iocs": [
     {
      "type": "url",
      "value": "https://lockbit3[.]onion/victims/usbank-data",
      "context": "Ransomware leak site"
     }
    ],
    "tags": [
     "lockbit",
     "ransomware",
     "finance",
     "data-leak",
     "double-extortion"
    ],
    "ttps": [
     {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
     },
     {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "Exfiltration"
     }
    ],
    "actor": {
     "name": "LockBit",
     "aliases": [
      "LockBit 3.0",
      "LockBit Black"
     ],
     "motivation": "financial",
     "nation_state": null
    },
    "target": {
     "sectors": [
      "finance"
     ],
     "countries": [
      "US"
     ],
     "organizations": [
      "Regional Bank Corp"
     ]
    },
    "channel": "https://t[.]me/darkwebinformer",
    "summary": "LockBit 3.0 claims breach of US regional bank — 2.4M customer records including SSNs posted to leak site",
    "category": "ransomware",
    "severity": "critical",
    "confidence": 88
   }
  ],
  "limit": 20,
  "total": 27,
  "offset": 0,
  "source": "TeleSint",
  "endpoint": "ransomware"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/telesint-ransomware-activity-feed-9a675f11/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from telesint-api.onrender.com](https://www.zero.xyz/host/telesint-api.onrender.com/llms.txt)