{"uid":"cap_7G5DA7o7VyAjdKUhQVXKe","slug":"telesint-watch-list-bd5b867e","name":"TeleSint Watch List","description":"Real-time cyber threat intelligence sourced from public Telegram CTI channels. Pay-per-call endpoints covering IOC extraction (IPs, domains, hashes, CVEs), C2 infrastructure lookup, threat actor profiles, breach disclosures, pre-attack intent signals, vulnerability and exploitation-in-the-wild tracking, ransomware group activity, malware family intelligence, dark web monitoring, cross-category keyword search, a unified threat feed, and deterministic adversary-preparation scoring (pre-attack verdicts, activity velocity, organisation mentions, claim recycling checks and wallet-bound watchlists). All records are AI-enriched by DeepSeek with MITRE ATT&CK technique tagging, confidence scoring (0-100), TLP classification, and structured JSON output. No API key — USDC micropayments on Base mainnet via x402.","url":"https://telesint-api.onrender.com/watch/list?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","properties":{"properties":{"type":"string"}}},"responseSchema":{"type":"json","example":{"total":1,"source":"TeleSint","endpoint":"watch/list","watchlists":[{"watch_id":"6f1d2c3b-4a5e-4f60-8a7b-9c0d1e2f3a4b"}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_r0qd9L5guS3DjUucEux-e","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Retrieves the list of active watchlists configured in the user's TeleSint account for persistent threat monitoring.","exampleAgentPrompt":"Show me all my active TeleSint watchlists so I can see which threat actors, wallet addresses, and keywords I'm currently tracking.","exampleUseCases":[{"title":"Auditing active threat monitoring configs","prompt":"Can you pull up the full list of watchlists I have set up in TeleSint? I want to see all the watch IDs so I know what threat actors and keywords I'm currently monitoring."},{"title":"Pre-incident response watchlist check","prompt":"Before we respond to this alert, show me all my active TeleSint watchlists — I want to confirm the affected organization and any related ransomware group are already in there."},{"title":"Wallet-bound watchlist inventory","prompt":"List all my current TeleSint watchlists — I need to verify which cryptocurrency wallet addresses and adversary groups I have on persistent watch right now."}],"resultDescription":"Returns a JSON object with a total count of watchlists, the source identifier ('TeleSint'), the endpoint name ('watch/list'), and an array of watchlist objects each containing a watch_id (UUID). This allows the caller to enumerate all active persistent monitoring configurations they have set up across threat categories.","failureModes":["No watchlists configured — returns empty array with total:0","Payment not processed — 402 response blocking access","Invalid or malformed properties filter — may return 400 or empty results","Upstream Telegram channel data unavailable — may return partial or stale results","Rate limiting or render cold-start delay on onrender.com — slow or timeout response"],"whenToPreferThis":"Use this endpoint when you need to enumerate all existing persistent monitoring configurations before creating, updating, or acting on watchlist-driven alerts. It is the natural first call in any workflow that manages watchlists — e.g. checking if a threat actor is already being tracked before adding a duplicate, or auditing coverage before an incident response. Prefer this over the full threat feed or keyword search endpoints when you need watchlist metadata (IDs, structure) rather than raw intelligence records.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-20T06:46:19.276Z","isFirstParty":false,"canonicalSlug":"telesint-watch-list-bd5b867e"}