{"uid":"cap_VMv9Md3roFz3DeBv1vpl4","slug":"telesint-cross-category-threat-intelligence-search-746ff158","name":"TeleSint Cross-Category Threat Intelligence Search","description":"Cross-category pivot across all TeleSint intel. Use ?q= for broad keyword or combine filters: category, severity, sector, country, tag, ttp, name, organization, min_confidence, since. Returns items[] across any category.","url":"https://telesint-api.onrender.com/search","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","properties":{"q":{"type":"string","description":"Broad keyword search across tags and summaries, e.g. lockbit, lazarus, cve-2026"},"tag":{"type":"string","description":"Tag keyword filter, e.g. ransomware, apt, cobalt-strike"},"ttp":{"type":"string","description":"MITRE ATT&CK technique ID prefix, e.g. T1059"},"name":{"type":"string","description":"Actor name partial match, e.g. lazarus, sandworm"},"limit":{"type":"number","description":"Page size, default 20, max 100"},"since":{"type":"string","description":"ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"},"offset":{"type":"number","description":"Pagination offset, default 0"},"sector":{"type":"string","description":"Target sector: finance | healthcare | government | energy | retail"},"country":{"type":"string","description":"Target country keyword, e.g. us | uk | de | fr"},"category":{"type":"string","description":"Narrow to one category: ioc | c2 | actor | breach | intent | vulnerability"},"severity":{"type":"string","description":"Minimum severity: critical | high | medium | low | info"},"organization":{"type":"string","description":"Target organization name partial match"},"min_confidence":{"type":"number","description":"Minimum AI confidence score 0-100"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"items":[{"id":"s1e2a3r4-c5h6-7890-abcd-search789012","ts":"2026-05-27T12:00:00Z","tlp":"WHITE","iocs":[{"type":"url","value":"https://lockbit3[.]onion/leak/fin-data","context":"Ransomware leak site"}],"tags":["lockbit","ransomware","finance","data-leak"],"ttps":[{"id":"T1486","name":"Data Encrypted for Impact","tactic":"Impact"}],"channel":"https://t[.]me/cyberinsider","summary":"LockBit claims breach of US financial institution — 2.4M records including SSNs and account numbers","category":"breach","severity":"critical","confidence":82}],"limit":20,"total":12,"offset":0,"source":"TeleSint","endpoint":"search"}},"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"q":"lockbit","tag":"ransomware","limit":20,"offset":0,"category":"actor","severity":"high","min_confidence":70}}},"response":{"items":[{"id":"8e4bb633a645337e","ts":"2026-06-15T11:39:24.000Z","tlp":"GREEN","iocs":[],"tags":["Conti","ransomware","guilty plea"],"ttps":[],"actor":{"name":"Conti","aliases":[],"motivation":"financial","nation_state":null},"msg_id":251801,"target":{"sectors":[],"countries":["Ukraine","United States"],"organizations":[]},"channel":"https://t.me/ctinow","summary":"Ukrainian man pleads guilty in US to charges related to Conti ransomware operations.","category":"actor","severity":"high","confidence":90,"translated":false,"ingested_at":"2026-06-15T11:41:31.109Z","hint_category":"intent","source_language":"en"},{"id":"b987cd364024edc0","ts":"2026-06-11T16:53:58.000Z","tlp":"GREEN","iocs":[],"tags":["ransomware","RaaS","affiliate","AI"],"ttps":[],"actor":{"name":"The Gentlemen","aliases":[],"motivation":"financial","nation_state":null},"msg_id":9218,"target":{"sectors":[],"countries":[],"organizations":[]},"channel":"https://t.me/TheHackerNews","summary":"The Gentlemen ransomware group evolved from an affiliate using LockBit, Qilin, and Medusa to running its own RaaS program claiming 478 victims.","category":"actor","severity":"high","confidence":80,"translated":false,"ingested_at":"2026-06-11T16:56:50.856Z","hint_category":"intent","source_language":"en"},{"id":"1e7992fe19417347","ts":"2026-06-11T16:07:14.000Z","tlp":"GREEN","iocs":[],"tags":["ransomware","crypto-laundering","law enforcement"],"ttps":[],"actor":{"name":"AudiA6","aliases":[],"motivation":"financial","nation_state":null},"msg_id":24879,"target":{"sectors":[],"countries":[],"organizations":[]},"channel":"https://t.me/BleepingComputer","summary":"Law enforcement dismantled the AudiA6 cryptocurrency laundering service used by ransomware actors to launder over $380 million.","category":"actor","severity":"high","confidence":90,"translated":false,"ingested_at":"2026-06-11T16:08:37.807Z","hint_category":"intent","source_language":"en"},{"id":"d99441ab3c6b7ce8","ts":"2026-06-08T13:09:29.000Z","tlp":"GREEN","iocs":[],"tags":["ransomware","vpn zero-day","attribution"],"ttps":[],"actor":{"name":"Qilin","aliases":[],"motivation":"financial","nation_state":null},"msg_id":251442,"target":{"sectors":[],"countries":[],"organizations":[]},"channel":"https://t.me/ctinow","summary":"Check Point attributes VPN zero-day attacks to the Qilin ransomware gang.","category":"actor","severity":"high","confidence":70,"translated":false,"ingested_at":"2026-06-08T13:10:45.997Z","hint_category":"intent","source_language":"en"},{"id":"6aee0de8de06397f","ts":"2026-06-03T20:39:21.000Z","tlp":"GREEN","iocs":[],"tags":["sanctions","crypto exchange","ransomware"],"ttps":[],"actor":{"name":"Nobitex","aliases":[],"motivation":"financial","nation_state":null},"msg_id":251255,"target":{"sectors":["Financial Services"],"countries":["United States"],"organizations":["Nobitex"]},"channel":"https://t.me/ctinow","summary":"U.S. sanctions Nobitex crypto exchange for its use by ransomware actors.","category":"actor","severity":"high","confidence":80,"translated":false,"ingested_at":"2026-06-03T20:41:49.881Z","hint_category":"intent","source_language":"en"},{"id":"231b9fc31b8a9933","ts":"2026-05-27T21:14:29.000Z","tlp":"GREEN","iocs":[],"tags":["ransomware","kill chain","Akira"],"ttps":[],"actor":{"name":"Akira","aliases":[],"motivation":"financial","nation_state":null},"msg_id":250924,"target":{"sectors":[],"countries":[],"organizations":[]},"channel":"https://t.me/ctinow","summary":"Reconstructing an Akira Ransomware kill chain from perimeter and endpoint logs.","category":"actor","severity":"high","confidence":80,"translated":false,"ingested_at":"2026-05-28T01:45:40.035Z","hint_category":null,"source_language":"en"},{"id":"7946447fe27b524c","ts":"2026-05-27T12:19:21.000Z","tlp":"AMBER","iocs":[],"tags":["ransomware","physical attack"],"ttps":[{"id":"T1592","name":"Gather Victim Host Information","tactic":"Reconnaissance"}],"actor":{"name":"Silent Ransom Group","aliases":["SRG"],"motivation":"financial","nation_state":null},"msg_id":24760,"target":{"sectors":["legal"],"countries":["United States"],"organizations":[]},"channel":"https://t.me/BleepingComputer","summary":"FBI warns Silent Ransom Group (SRG) is conducting in-person data theft attacks targeting U.S. law firms.","category":"actor","severity":"high","confidence":90,"translated":false,"ingested_at":"2026-05-31T16:17:16.331Z","hint_category":"intent","source_language":"en"},{"id":"d2ea095a166c965b","ts":"2026-05-22T17:37:20.000Z","tlp":"GREEN","iocs":[{"type":"domain","value":"1vpns[.]com","context":"Seized domain of First VPN criminal service."},{"type":"domain","value":"1vpns[.]net","context":"Seized domain of First VPN criminal service."},{"type":"domain","value":"1vpns[.]org","context":"Seized domain of First VPN criminal service."}],"tags":["First VPN","ransomware","takedown","criminal VPN","seized domains"],"ttps":[{"id":"T1090.003","name":"Proxy: Multi-hop Proxy","tactic":"Command and Control"}],"actor":{"name":"First VPN","aliases":[],"motivation":"Financial crime","nation_state":null},"msg_id":9065,"target":{"sectors":[],"countries":[],"organizations":[]},"channel":"https://t.me/TheHackerNews","summary":"First VPN, a criminal VPN service used by at least 25 ransomware groups, was dismantled in a global takedown operation seizing 33 servers and domains including 1vpns[.]com.","category":"actor","severity":"high","confidence":95,"translated":false,"ingested_at":"2026-05-31T16:12:46.282Z","hint_category":"intent","source_language":"en"},{"id":"119303fc6030f47b","ts":"2026-05-20T14:39:17.000Z","tlp":"AMBER","iocs":[],"tags":["fox-tempest","malware-signing","code-signing","ransomware"],"ttps":[],"actor":{"name":"Fox Tempest","aliases":[],"motivation":"cybercrime","nation_state":null},"msg_id":9048,"target":{"sectors":[],"countries":[],"organizations":["Microsoft"]},"channel":"https://t.me/TheHackerNews","summary":"Microsoft disrupted Fox Tempest's malware-signing-as-a-service operation abusing Artifact Signing.","category":"actor","severity":"high","confidence":85,"translated":false,"ingested_at":"2026-05-31T16:13:19.179Z","hint_category":"intent","source_language":"en"},{"id":"a837e065145b4384","ts":"2026-01-13T14:37:23.000Z","tlp":"GREEN","iocs":[],"tags":["android","banking","ransomware","rat"],"ttps":[],"actor":{"name":"deVixor","aliases":[],"motivation":"financial","nation_state":null},"msg_id":2791,"target":{"sectors":["banking"],"countries":["Iran"],"organizations":[]},"channel":"https://t.me/AndroidMalware","summary":"Cyble report on deVixor Android banking RAT with ransomware capabilities targeting Iran.","category":"actor","severity":"high","confidence":75,"translated":false,"ingested_at":"2026-05-31T16:25:36.398Z","hint_category":"intent","source_language":"en"}],"total":10,"source":"TeleSint","endpoint":"search"}},"exampleRequest":{"q":"lockbit","tag":"ransomware","limit":20,"offset":0,"category":"actor","severity":"high","min_confidence":70},"tags":["x402"],"displayCostAmount":"0.04","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.04/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.04","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.04","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_5lm2fka5G_JBaY5Y5hK5p","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.04","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Searches across all Telegram-sourced CTI categories (IOCs, actors, breaches, vulnerabilities, malware, etc.) using keywords, tags, MITRE ATT&CK techniques, and filters to return AI-enriched threat intelligence records","exampleAgentPrompt":"Search TeleSint for recent critical-severity threat intelligence about LockBit ransomware targeting the finance sector — show me the top 20 results with at least 70 confidence, from the last 30 days.","exampleUseCases":null,"resultDescription":"A paginated JSON array of threat intelligence records, each containing: unique ID, timestamp, TLP classification, IOCs with context, MITRE ATT&CK TTP tags, source Telegram channel, AI-generated summary, category, severity, and confidence score (0-100). Also includes total count, limit, and offset for pagination.","failureModes":["Payment not received — 402 response if USDC micropayment on Base is not completed","Invalid query parameters — 400 if enum values like category or severity are not from allowed set","No results found — empty items array with total=0 when no records match the filters","Rate limiting or server overload — 429 or 503 from Render.com hosting","since parameter malformed — 400 if ISO 8601 timestamp is not correctly formatted","min_confidence out of range — 400 if value is not between 0 and 100"],"whenToPreferThis":"Use this endpoint when you need a broad, cross-category search across all CTI data types at once — ideal when you don't know which specific category (IOC, actor, breach, vulnerability) a threat falls into, or when you want to correlate signals across multiple categories. Prefer the specialized sibling endpoints (ioc, actor, breach, etc.) when you know the exact category for more targeted results.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T12:48:57.534Z","isFirstParty":false}