{"uid":"cap_b9hED_3yWCNwnyShVF-f0","slug":"rocketcore-intel-ssh-username-spray-intelligence-5e4b8b1e","name":"RocketCore Intel — SSH Username Spray Intelligence","description":"x402 pay-per-request AI-commerce API on Base mainnet (USDC). Serves sanitized, aggregated intelligence products. Discovery via /catalog and /.well-known/x402.","url":"https://intel.rocket-core.com/v1/cyber/ssh-username-spray?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","required":[],"properties":{"ref":{"enum":["x402scan","agentic-market","pay-sh","ampersend","x402-list","signal402","x402-slack","x402-discord","gitlab","mcp","x","linkedin","hackernews","dev","reddit","poncho","agentcash","base-discord"],"type":"string","description":"Optional allowlisted referral source (attribution only)."},"window":{"enum":["24h","7d","30d"],"type":"string","default":"24h","description":"Aggregation window."}},"additionalProperties":false}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["product","window","generated_at","source","k_min","total_usernames_observed","total_attacks","usernames","dataset_version","freshness","sanitizer_version","schema_version","methodology","privacy_threshold","suppression_count","limitations","observation_start","observation_end"],"properties":{"k_min":{"type":"integer","minimum":1},"source":{"type":"string"},"window":{"enum":["24h","7d","30d"],"type":"string"},"product":{"type":"string"},"freshness":{"type":"string"},"usernames":{"type":"array","items":{"type":"object","required":["username","spray_buckets","attack_volume","distinct_source_estimate","volume_share"],"properties":{"username":{"type":"string","description":"Coarse attempted login name; no credentials."},"volume_share":{"type":"number","maximum":1,"minimum":0},"attack_volume":{"type":"integer","minimum":0},"spray_buckets":{"type":"integer","minimum":1},"distinct_source_estimate":{"type":"integer","minimum":0}},"additionalProperties":false}},"limitations":{"type":"string"},"methodology":{"type":"string"},"generated_at":{"type":"string"},"total_attacks":{"type":"integer","minimum":0},"schema_version":{"type":"string"},"dataset_version":{"type":["string","null"]},"observation_end":{"type":["string","null"]},"observation_start":{"type":["string","null"]},"privacy_threshold":{"type":"integer","minimum":1},"sanitizer_version":{"type":"string"},"suppression_count":{"type":"integer","minimum":0},"total_usernames_observed":{"type":"integer","minimum":0}},"additionalProperties":false}}}}},"responseSchema":{"type":"json","example":{"source":"RocketCore honeypot fleet (sanitized, k>=5 aggregated)","product":"ssh-username-spray","freshness":"see response"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"down","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_oBiBCG__a5Fky6n5_gzMA","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns aggregated, sanitized intelligence on the most commonly attempted SSH login usernames observed across a honeypot fleet, covering a specified time window.","exampleAgentPrompt":"Pull the latest SSH username spray intelligence from RocketCore's honeypot fleet for the past 7 days — I want to see which usernames are being hit hardest so I can tighten up my SSH detection rules.","exampleUseCases":[{"title":"Update SIEM SSH detection rules","prompt":"Get me the top SSH spray usernames from the last 24 hours from RocketCore Intel so I can update our SIEM alerting rules with the most actively targeted accounts right now."},{"title":"Monthly threat report on SSH attacks","prompt":"Fetch RocketCore's 30-day SSH username spray data — I need to include the most attacked usernames, their attack volumes, and volume shares in our monthly threat intelligence report."},{"title":"Harden SSH config on new servers","prompt":"What are the most commonly attempted SSH login usernames over the past week according to RocketCore's honeypot data? I want to make sure we're blocking or renaming those accounts before we go live."}],"resultDescription":"A JSON object listing the top SSH usernames observed in spray attacks across the RocketCore honeypot fleet during the requested window. Each username entry includes attack volume, number of distinct spray buckets, an estimated distinct source count, and share of total attack volume. The response also includes metadata: observation start/end timestamps, dataset and sanitizer version, methodology description, privacy threshold (k_min), suppression count (entries withheld for privacy), freshness indicator, and limitations disclaimer.","failureModes":["Payment not accepted or insufficient USDC balance — 402 response with payment requirements","Invalid window parameter value — schema validation error","No data available for the requested window — may return empty usernames array","Rate limiting or quota exceeded — HTTP 429","Service unavailable if honeypot fleet data pipeline is delayed — may return stale or no results"],"whenToPreferThis":"Choose this endpoint when you need current, honeypot-derived, privacy-safe SSH spray username data with volume statistics and aggregation metadata. It is particularly well-suited for feeding SIEM rules, intrusion detection systems, or threat intelligence reports with real-world attack signal. Prefer it over static blocklists or CVE feeds when you need live, frequency-ranked SSH attack username intelligence with provenance and methodology transparency.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T20:27:54.289Z","isFirstParty":false,"canonicalSlug":"rocketcore-intel-ssh-username-spray-intelligence-5e4b8b1e"}