W3 Intel is Agent Chain's real-time threat intelligence product for the open (surface) web. Every interaction with Agent Chain's honeypot infrastructure generates a W3 Intel Sighting Card — a structured threat intelligence record that captures attacker identity, behavior, geolocation, flags, and MITRE ATT&CK techniques.
It's the VirusTotal for AI agents — except instead of files, you're scanning agent behaviors.
/api/v1/trending and /api/v1/stats only.Each sighting card is a complete intelligence record. Here's what a CRITICAL-severity card looks like:
Agent Chain
| Field | Type | Description |
|---|---|---|
id | string | Unique sighting card ID (AC-W3Intel #N) |
agent_fingerprint | string | SHA-256 behavioral fingerprint |
agent_did | string | DID if known, unknown otherwise |
threat_level | enum | critical / high / medium / low / unknown |
risk_score | integer | 0–100 risk score |
encounter_count | integer | Total times this agent has been seen |
source | string | Detection origin: Passive Honeypot, Active Client Honeypot, Dark Web Crawl |
classification_tags | string[] | Attack categories (e.g., Wallet Drainer, Prompt Injection) |
mitre_techniques | string[] | MITRE ATT&CK technique IDs |
framework | string | Detected LLM framework (LangChain, AutoGen, CrewAI, etc.) |
model | string | LLM model if detectable (GPT-4o, Claude, Gemini, etc.) |
geo_country | string | ISO country code of origin IP |
geo_asn | string | ASN of origin (e.g., AS14061 DigitalOcean) |
flags | object | Boolean flags: walletDrain, promptInjection, dataExfil, jailbreak, c2, impersonation |
first_seen | ISO 8601 | When this agent was first encountered |
last_seen | ISO 8601 | Most recent encounter |
merkle_hash | string | Hash of this card's data, included in daily L1 Merkle anchor |
Every 24 hours, a Merkle root of all sighting cards is hashed and written to the Agent Chain L1 blockchain. This provides cryptographic, tamper-evident proof that the intelligence data hasn't been altered since publication.
Any subscriber can verify any individual sighting card against the daily anchor:
| Method | Endpoint | Description |
|---|---|---|
| GET | /v1/w3intel/trending | Top 10 trending threats (public) |
| GET | /v1/w3intel/stats | Platform-wide threat stats |
| GET | /v1/w3intel/anchors | Daily Merkle anchor history |
| Method | Endpoint | Description |
|---|---|---|
| GET | /v1/w3intel/sightings | All sighting cards (paginated, filterable) |
| GET | /v1/w3intel/sightings/:id | Get a specific sighting card |
| GET | /v1/w3intel/agents/:fingerprint | Get all sightings for an agent fingerprint |
| GET | /v1/w3intel/search | Search by framework, model, country, tag, MITRE technique |
| GET | /v1/w3intel/export | Bulk export in JSON or CSV |
| GET | /v1/w3intel/feed | Real-time sighting feed (streaming) |
| GET | /v1/w3intel/mitre | MITRE ATT&CK technique frequency map |
| GET | /v1/w3intel/geo | GeoIP breakdown of attacker origins |