{"uid":"cap_BavCSntPtQNa4xq9gYyQo","slug":"telesint-asn-threat-intelligence-lookup-58b0919f","name":"TeleSint ASN Threat Intelligence Lookup","description":"ASN threat intel from Telegram CTI channels. Pass ?asn=AS215540. Returns C2/phishing-kit associations, threat actor mentions, bulletproof hosting flag, blocking recommendation with WAF hint, and record IDs for pivoting into /c2 or /ioc.","url":"https://telesint-api.onrender.com/asn","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["asn"],"properties":{"asn":{"type":"string","description":"ASN identifier e.g. AS215540, AS9009, AS14061"},"org":{"type":"string","description":"Optional org name fragment e.g. hivelocity, digitalocean, m247"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"asn":"AS215540","source":"TeleSint","org_name":"GLOBAL CONNECTIVITY SOLUTIONS LLP","freshness":"2026-06-19T10:00:00Z","confidence":"high","data_sources":["TeleSint-Telegram-CTI","DeepSeek-CTI-Analysis"],"threat_actors":["Storm-1167","scattered spider"],"waf_rule_hint":"Cloudflare WAF: ASN 215540 | AWS WAF AsnMatchStatement: [215540]","c2_associations":["Cobalt Strike","Havoc"],"abuse_categories":["bulletproof_hosting","phishing","c2"],"telegram_mentions":14,"bulletproof_indicator":true,"recent_telegram_intel":["f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d"],"blocking_recommendation":"BLOCK — repeatedly mentioned in Telegram CTI as preferred C2 and AiTM hosting provider","phishing_kit_associations":["Tycoon2FA","NakedPages","Sneaky2FA"]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_F7rwOD6AIzrHYT2Je3_dz","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Looks up an Autonomous System Number (ASN) against Telegram-sourced cyber threat intelligence, returning threat actors, C2 associations, abuse categories, phishing kits, bulletproof hosting indicators, and blocking recommendations.","exampleAgentPrompt":"Pull TeleSint threat intelligence on ASN AS215540 — I want to know if it's linked to bulletproof hosting, any C2 frameworks like Cobalt Strike, which threat actors are using it, and whether I should block it at the firewall.","exampleUseCases":null,"resultDescription":"Returns a structured JSON object containing the ASN and org name, confidence level, data sources, a list of associated threat actors (e.g. Storm-1167, Scattered Spider), C2 framework associations, abuse categories (bulletproof hosting, phishing, C2), phishing kit associations (Tycoon2FA, etc.), a bulletproof hosting boolean indicator, count of Telegram channel mentions, recent Telegram intel record IDs, a WAF rule hint for Cloudflare/AWS WAF, a blocking recommendation, and freshness timestamp — all enriched by DeepSeek with MITRE ATT&CK tagging.","failureModes":["Missing or invalid ASN parameter returns a 400 or error response","ASN not found in Telegram CTI data returns empty or low-confidence result","Payment not completed via USDC/x402 returns 402 Payment Required","Render.com cold start may cause elevated latency on first call","ASN data may be stale if not recently mentioned in monitored Telegram channels"],"whenToPreferThis":"Use this endpoint when you need Telegram-sourced, community-driven threat intelligence on a specific ASN — especially for identifying bulletproof hosting providers, C2 infrastructure, and phishing-as-a-service networks that may not appear in traditional commercial threat feeds. Prefer this over generic WHOIS or IP reputation services when you want MITRE ATT&CK-tagged, AI-enriched intelligence with real-world attacker attribution and WAF rule generation.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T00:31:17.638Z","isFirstParty":false}