Tool detail

ioc

Returns indicators of compromise (IP, domain, URL, hash, CVE) extracted from Telegram threat-intel channels, with confidence and severity.

Categories: Security

Use when

pull recent IOCs of a given type above a confidence threshold
filter threat-intel indicators by severity or TLP classification
monitor a specific Telegram CTI channel for new IOCs

Not for

C2 infrastructure and threat-actor profiles are separate endpoints (/c2, /actor)

Inputs

GET query params (all optional): type, severity, min_confidence, since, tlp, tag, channel, limit, offset

Admitted input schema

{
  "type": "object",
  "properties": {
    "channel": {
      "type": "string",
      "minLength": 0,
      "maxLength": 4096,
      "description": "Partial match on source Telegram channel name"
    },
    "limit": {
      "type": "number",
      "minimum": -9007199254740991,
      "maximum": 9007199254740991,
      "description": "Page size, default 20, max 100"
    },
    "min_confidence": {
      "type": "number",
      "minimum": -9007199254740991,
      "maximum": 9007199254740991,
      "description": "Minimum AI confidence score 0-100"
    },
    "offset": {
      "type": "number",
      "minimum": -9007199254740991,
      "maximum": 9007199254740991,
      "description": "Pagination offset, default 0"
    },
    "severity": {
      "type": "string",
      "minLength": 0,
      "maxLength": 4096,
      "description": "Minimum severity: critical | high | medium | low | info"
    },
    "since": {
      "type": "string",
      "minLength": 0,
      "maxLength": 4096,
      "description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
    },
    "tag": {
      "type": "string",
      "minLength": 0,
      "maxLength": 4096,
      "description": "Tag keyword filter, e.g. ransomware, cobalt-strike, apt"
    },
    "tlp": {
      "type": "string",
      "minLength": 0,
      "maxLength": 4096,
      "description": "TLP classification: WHITE | GREEN | AMBER | RED"
    },
    "type": {
      "type": "string",
      "minLength": 0,
      "maxLength": 4096,
      "description": "IOC type: ip | domain | url | md5 | sha1 | sha256 | cve"
    }
  },
  "required": [],
  "additionalProperties": false
}

Endpoint

Method: GET
URL: https://telesint-api.onrender.com/ioc

Payment

Protocol: x402
Listed price: 0.01 USDC per call on Base
Payment method: exact
Network: eip155:8453
Asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Listed terms are catalog metadata. The caller supplies inputs and calls the tool outside Onelayer. If payment is required, the caller uses a compatible wallet to pay.

Source

Directory: Coinbase x402 Bazaar
Record: GET https://telesint-api.onrender.com/ioc
Retrieved: 2026-09-30T20:37:07.382Z
Catalog file SHA-256: 6837ccddf886f0007cf3727ea9d27faaa5047b51b4f425345c554ce1c271a524
Catalog built: 2026-09-30T22:31:58.034Z