Parameters7
| Parameter | Type | Default | Example |
|---|---|---|---|
limit | number | null | 20 |
motivation | string | null | financial |
name | string | null | lazarus |
nation_state | string | null | kp |
offset | number | null | 0 |
severity | string | null | high |
ttp | string | null | T1566 |
Service overview
ASN threat intelligence from Telegram CTI channels. Pass ?asn=AS215540. Returns C2 framework associations, phishing kit links (Tycoon2FA, EvilProxy, NakedPages), threat actor mentions, bulletproof hosting indicators, blocking recommendation with WAF rule hint, and matching TeleSint record IDs for pivoting into /c2 or /ioc. Distinct from OT-Intel /ot/asn — angle is cybercriminal Telegram chatter about hosting infrastructure, not ICS actor campaigns.
Level up your agent by giving it access to thousands of services. All payable per-request via x402. No API keys, no accounts.
Paste into your agentic chat and let your agent guide you.
npx awal x402 pay "https://telesint-api.onrender.com/actor" \
--query '{
"limit": "{limit}",
"motivation": "{motivation}",
"name": "{name}",
"nation_state": "{nation_state}",
"offset": "{offset}",
"severity": "{severity}",
"ttp": "{ttp}"
}'{
"endpoint": "GET /actor",
"paid": true,
"query": "example input",
"result": {
"value": "Structured response from the service."
}
}API surface
14 crawlable routes
| Parameter | Type | Default | Example |
|---|---|---|---|
limit | number | null | 20 |
motivation | string | null | financial |
name | string | null | lazarus |
nation_state | string | null | kp |
offset | number | null | 0 |
severity | string | null | high |
ttp | string | null | T1566 |
| Parameter | Type | Default | Example |
|---|---|---|---|
format | string | null | sigma |
id | string | null | f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d |
| Parameter | Type | Default | Example |
|---|---|---|---|
asn | string | null | AS215540 |
| Parameter | Type | Default | Example |
|---|---|---|---|
country | string | null | us |
limit | number | null | 20 |
min_confidence | number | null | 60 |
offset | number | null | 0 |
organization | string | null | acme |
sector | string | null | finance |
severity | string | null | high |
since | string | null | 2026-05-01T00:00:00Z |
| Parameter | Type | Default | Example |
|---|---|---|---|
framework | string | null | cobalt_strike |
limit | number | null | 20 |
min_confidence | number | null | 70 |
offset | number | null | 0 |
severity | string | null | high |
since | string | null | 2026-05-01T00:00:00Z |
tag | string | null | c2 |
| Parameter | Type | Default | Example |
|---|---|---|---|
limit | number | null | 20 |
min_confidence | number | null | 60 |
offset | number | null | 0 |
sector | string | null | finance |
severity | string | null | high |
since | string | null | 2026-05-01T00:00:00Z |
tag | string | null | access-broker |
| Parameter | Type | Default | Example |
|---|---|---|---|
category | string | null | ioc |
limit | number | null | 20 |
min_confidence | number | null | 60 |
offset | number | null | 0 |
severity | string | null | high |
since | string | null | 2026-05-01T00:00:00Z |
tag | string | null | ransomware |
tlp | string | null | WHITE |
| Parameter | Type | Default | Example |
|---|---|---|---|
country | string | null | us |
intent_type | string | null | ransomware |
limit | number | null | 20 |
offset | number | null | 0 |
organization | string | null | hospital |
sector | string | null | healthcare |
| Parameter | Type | Default | Example |
|---|---|---|---|
channel | string | null | vxunderground |
limit | number | null | 20 |
min_confidence | number | null | 70 |
offset | number | null | 0 |
severity | string | null | high |
since | string | null | 2026-05-01T00:00:00Z |
tag | string | null | ransomware |
tlp | string | null | WHITE |
type | string | null | ip |
| Parameter | Type | Default | Example |
|---|---|---|---|
limit | number | null | 20 |
min_confidence | number | null | 60 |
offset | number | null | 0 |
severity | string | null | high |
since | string | null | 2026-05-01T00:00:00Z |
tag | string | null | stealer |
| Parameter | Type | Default | Example |
|---|---|---|---|
country | string | null | us |
limit | number | null | 20 |
min_confidence | number | null | 60 |
offset | number | null | 0 |
sector | string | null | finance |
severity | string | null | high |
since | string | null | 2026-05-01T00:00:00Z |
tag | string | null | lockbit |
| Parameter | Type | Default | Example |
|---|---|---|---|
category | string | null | breach |
country | string | null | us |
limit | number | null | 20 |
min_confidence | number | null | 60 |
offset | number | null | 0 |
q | string | null | lockbit |
sector | string | null | finance |
severity | string | null | high |
| Parameter | Type | Default | Example |
|---|---|---|---|
id | string | null | f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d |
include_raw | string | null | true |
| Parameter | Type | Default | Example |
|---|---|---|---|
limit | number | null | 20 |
min_confidence | number | null | 60 |
offset | number | null | 0 |
severity | string | null | high |
since | string | null | 2026-05-01T00:00:00Z |
tag | string | null | cve |
type | string | null | cve |
FAQ
Service
CuseTheJuice mailbox @ mail.cusethejuice.com — change mailbox password (current password + new_password in JSON). Agents: pay with x402 (Base USDC), POST JSON using fields from extensions.bazaar on the 402. Full catalog, examples, human flows: https://mail.cusethejuice.com/machine-mail.html · Find every route: Coinbase CDP x402 merchant discovery (payTo).
Service
NFT metadata, traits, and image URI for any ERC721 or ERC1155 token - fetched via eth_call with IPFS resolution (OneSource live Ethereum RPC)
Service
Agent-driven wallet due diligence — multi-step investigation, signed markdown report + JSON sidecar, dual-chain anchored. Async — returns job_id; poll /v1/investigate/status/{job_id} for the deliverable. ETA 5-10 min. $1.77 USDC.