{"uid":"cap_y2gMBSVMkSpjDcnK57U1l","slug":"telesint-api-onrender-com-24f849c4","name":"TeleSint C2 Infrastructure Feed","description":"C2 infrastructure from Telegram. Filters: framework(cobalt_strike|sliver|havoc|brute_ratel), severity, min_confidence, since, tag, limit, offset. Returns items[] with C2 IPs/domains, MITRE TTPs, confidence.","url":"https://telesint-api.onrender.com/c2","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","properties":{"tag":{"type":"string","description":"Tag keyword filter, e.g. cobalt-strike, sliver, c2"},"limit":{"type":"number","description":"Page size, default 20, max 100"},"since":{"type":"string","description":"ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"},"offset":{"type":"number","description":"Pagination offset, default 0"},"severity":{"type":"string","description":"Minimum severity: critical | high | medium | low | info"},"framework":{"type":"string","description":"C2 framework: cobalt_strike | sliver | havoc | brute_ratel | metasploit"},"min_confidence":{"type":"number","description":"Minimum AI confidence score 0-100"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"items":[{"id":"c2a1b2c3-d4e5-f6a7-b8c9-d0e1f2a3b4c5","ts":"2026-05-27T09:15:00Z","tlp":"WHITE","iocs":[{"type":"ip","value":"91.92[.]109.83","context":"Cobalt Strike team server"},{"type":"domain","value":"windowsupdate[.]xyz","context":"Malleable C2 domain"},{"type":"url","value":"https://91.92[.]109.83/updates","context":"Beacon callback URL"}],"tags":["cobalt-strike","malleable-c2","windows-masquerade"],"ttps":[{"id":"T1071.001","name":"Application Layer Protocol: Web Protocols","tactic":"Command and Control"},{"id":"T1573.001","name":"Encrypted Channel: Symmetric Cryptography","tactic":"Command and Control"}],"channel":"https://t[.]me/malwrhunterteam","summary":"Cobalt Strike beacon detected with malleable C2 profile mimicking Microsoft update traffic","category":"c2","severity":"critical","confidence":90}],"limit":20,"total":8,"offset":0,"source":"TeleSint","endpoint":"c2"}},"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{}}},"response":{"items":[],"total":0,"source":"TeleSint","endpoint":"c2"}},"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_fiq1FxFzJpxxW5Z5wAVQ3","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns active C2 (command-and-control) infrastructure intelligence — IPs, domains, MITRE TTPs, and confidence scores — sourced from Telegram threat intelligence channels, filterable by C2 framework, severity, and confidence.","exampleAgentPrompt":"Pull the latest high-severity Cobalt Strike C2 infrastructure from TeleSint — filter for confidence above 80 and show me the IPs, domains, and associated MITRE TTPs from the past week.","exampleUseCases":null,"resultDescription":"Returns an array of C2 infrastructure items, each containing C2 IPs and/or domains, associated MITRE ATT&CK TTPs, a confidence score, framework identification (e.g. cobalt_strike, sliver), severity rating, and relevant tags sourced from Telegram CTI channels.","failureModes":["Invalid framework enum value returns 400 bad request","No results for overly restrictive filter combination returns empty items array","Service unavailable on Render cold start returns 503","Invalid since timestamp format returns 400 parse error","Offset exceeding result set returns empty items array"],"whenToPreferThis":"Use this endpoint when you need C2 infrastructure indicators specifically (IPs/domains used for command-and-control), especially when you need to filter by specific C2 frameworks like Cobalt Strike or Sliver. Prefer this over the generic IOC feed when your use case is network-level C2 detection or blocking, or when you need MITRE TTP context linked directly to active C2 infrastructure sourced from Telegram threat intelligence communities.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T12:57:24.300Z","isFirstParty":false}