Tool market

Dark-web threat intelligence

Threat intelligence API that extracts indicators of compromise, C2 infrastructure, threat actor profiles, breach disclosures and CVE signals from public Telegram security channels, returned as structured JSON with MITRE ATT&CK tags and confidence scores.

TeleSint

Ioc

IOC feed from Telegram CTI channels. Filters: type(ip|domain|url|hash|cve), severity, min_confidence, since, tlp, tag, channel, limit, offset. Returns items[] with iocs[], ttps[], confidence, severity, tlp, tags[].

TeleSint

Threat-intelligence artifacts

Threat intelligence API that extracts indicators of compromise, C2 infrastructure, threat actor profiles, breach disclosures and CVE signals from public Telegram security channels, returned as structured JSON with MITRE ATT&CK tags and confidence scores.

TeleSint

V1 Threat Scanners

Recent IPs caught probing Polyform's honeypot paths (credential/vuln scanners) — Polyform's own first-party telemetry, not a repackaged public list. Returns up to 500 most-recent scanner IPs with first-seen. For blocklists and threat research. JSON.

Polyform

Pre-attack intent signals

Threat intelligence API that extracts indicators of compromise, C2 infrastructure, threat actor profiles, breach disclosures and CVE signals from public Telegram security channels, returned as structured JSON with MITRE ATT&CK tags and confidence scores.

TeleSint

Api Services Media Content Verification

Check whether an image or video is authentic and where it came from: C2PA content credentials, provenance and metadata extraction, with an avatar and logo impersonation check. Detect AI-generated or tampered media before trusting it

Cybercentry

Asn

ASN threat intel from Telegram CTI channels. Pass ?asn=AS215540. Returns C2/phishing-kit associations, threat actor mentions, bulletproof hosting flag, blocking recommendation with WAF hint, and record IDs for pivoting into /c2 or /ioc.

TeleSint

Threat Hash

File-hash reputation and known-file context for a SOC or DFIR agent. Give an md5, sha1 or sha256 hash and get CIRCL hashlookup known-file status, a hashlookup trust score and file metadata (name, size, mimetype, source, database), plus malware family when a licensed feed is enabled. A known distribution or system file lowers the alert priority; an unknown hash is not itself evidence of malice. Indicators, not a guarantee.

api.agentstools.dev

Threat-intelligence sources

Threat intelligence API that extracts indicators of compromise, C2 infrastructure, threat actor profiles, breach disclosures and CVE signals from public Telegram security channels, returned as structured JSON with MITRE ATT&CK tags and confidence scores.

TeleSint

Ransomware

Ransomware group activity from Telegram: victim posts, leak site announcements, extortion demands. Filters: severity, min_confidence, since, tag(lockbit|blackcat|cl0p|ransomhub), sector, country, limit, offset.

TeleSint

Vulnerability

CVE and exploitation-in-the-wild signals from Telegram CTI channels. Filters: severity, min_confidence, since, tag(cve|exploit|poc|patch), ttp, type(cve), limit, offset. Returns CVE IDs, affected products, exploit status.

TeleSint

Functions V1 Api Gateway Fraud Check

Score a signup for fraud risk. Send email only, ip only, or both; at least one is required. Email checks cover disposable and free provider detection, MX validation, gibberish name detection, domain liveness, and known business signals. IP checks cover VPN, proxy, Tor, residential relay, datacenter, and bogon detection. Returns a decision of allow, review, or block with a risk score and itemized signals.

Bytemine

Api V1 Vpn Ip Address

Detect whether an IP address is using a VPN, proxy or other anonymization service. Call before trusting an IP's geolocation for compliance rules, fraud checks or access gating. Returns vpn true/false, or "unknown" when no privacy data exists for the IP.

CompliAPI

Breach intelligence

Threat intelligence API that extracts indicators of compromise, C2 infrastructure, threat actor profiles, breach disclosures and CVE signals from public Telegram security channels, returned as structured JSON with MITRE ATT&CK tags and confidence scores.

TeleSint

Scan a package, skill, or MCP tool

Deterministic pre-install malware verification for npm packages, AI agent skills, and MCP tools. Behavioral scan with file-and-line evidence for 0.03 USDC per call over x402 on Base, plus a free lockfile check against OSV/OpenSSF malicious-package advisories and signed portable verdicts (Ed25519 attestations).

Lazaretto

Search

Cross-category pivot across all TeleSint intel. Use ?q= for broad keyword or combine filters: category, severity, sector, country, tag, ttp, name, organization, min_confidence, since. Returns items[] across any category.

TeleSint

Actor

Threat actor profiles from Telegram. Filters: name, nation_state(kp|ru|cn|ir), motivation(financial|espionage|hacktivism), ttp, severity, limit. Returns items[] with actor{}, ttps[], target{sectors,countries}.

TeleSint

Domain Trust

Phishing/trust verdict for a website domain before an agent transacts with an unfamiliar merchant. Fuses registration age (RDAP), DNS/mail posture (SPF, DMARC, DNSSEC), TLS validity, Certificate Transparency history and a typosquat/homoglyph analysis into a composite trust score 0-100, a category (trusted / caution / untrusted / unknown), per-dimension flags and reasons. Trust indicators, not a guarantee.

api.agentstools.dev

Threat-intelligence feed

Threat intelligence API that extracts indicators of compromise, C2 infrastructure, threat actor profiles, breach disclosures and CVE signals from public Telegram security channels, returned as structured JSON with MITRE ATT&CK tags and confidence scores.

TeleSint

Malware intelligence

Threat intelligence API that extracts indicators of compromise, C2 infrastructure, threat actor profiles, breach disclosures and CVE signals from public Telegram security channels, returned as structured JSON with MITRE ATT&CK tags and confidence scores.

TeleSint

V1 Regulateurs Fr Alertes

French financial regulator alerts and scam check against the official AMF blacklist: screen a name for unauthorized investment websites, scams and AMF impersonation, and look up PSAN crypto provider registrations and licensed asset management companies (SGP) by name or SIREN. A compliance screening of the regulator blacklists for agents vetting French counterparties in crypto and asset management. Official AMF open data (Licence Ouverte 2.0), refreshed daily.

Sirenic

Fraud Score

Fusion anti-abuse risk score for an email and/or IP in one call. Combines domain-level email intelligence (MX, SPF, DMARC, disposable, free, role) with IP reputation into a deterministic 0-100 score with per-dimension reasons. Works with either input alone.

api.agentstools.dev

V1 Threat Ip

Is this IP hostile? Reputation verdict for an IPv4 from public abuse feeds (blocklist.de, Spamhaus DROP) plus Polyform's own observed scanner traffic. Returns malicious flag, 0-100 score, and which sources flagged it. For bot filtering, fraud and firewall automation. JSON.

Polyform

V1 Scan Incoming

Payment security firewall scan for an INCOMING x402 payment request (402 offer): resource URL risk, credential-demand detection, price sanity, replay detection, canonical-USDC asset verification, merchant pinning, and counterparty reputation. Returns allow/flag/block with per-check reasons and an Ed25519-signed verdict. Advisory and non-custodial.

TollWarden

V1 Scan Outgoing

Payment security firewall scan for an OUTGOING x402 payment: PII/secret leak detection in payment metadata, nonce replay detection, overpayment detection, prompt-injection-triggered payment analysis (fast + deep tiers), canonical-USDC asset verification, merchant pinning, velocity/spend caps, and counterparty reputation cross-check. Returns allow/flag/block with per-check reasons and an Ed25519-signed verdict. Advisory and non-custodial.

TollWarden

Fraud Ip

Reputation of a public IP address for anti-abuse and KYC. Returns ASN, AS-org, country, datacenter/hosting classification, Tor-exit and Spamhaus DROP flags, plus a deterministic risk score with reasons.

api.agentstools.dev

Command-and-control infrastructure intelligence

Threat intelligence API that extracts indicators of compromise, C2 infrastructure, threat actor profiles, breach disclosures and CVE signals from public Telegram security channels, returned as structured JSON with MITRE ATT&CK tags and confidence scores.

TeleSint