{"uid":"cap_X21rsyZ4RCstKyNcjcnuc","slug":"ot-intel-api-asn-infrastructure-profiling-be5d5a46","name":"OT Intel API — ASN Infrastructure Profiling","description":"ICS threat actor ASN infrastructure profiling. Pass ?asn=AS215540. Returns ICS actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, NakedPages), bulletproof hosting indicators, abuse categories (c2, staging, phishing), and an OT-specific blocking recommendation with WAF rule hint. ASN analysis reveals infrastructure clustering that survives IP/domain rotation — critical for OT defenders tracking persistent actor infrastructure.","url":"https://ot-intel-api.onrender.com/ot/asn","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["asn"],"properties":{"asn":{"type":"string","description":"ASN identifier e.g. AS215540, AS9009, AS29802"},"org":{"type":"string","description":"Optional org name fragment e.g. hivelocity, m247, globalconnectivity"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"asn":"AS215540","org_name":"GLOBAL CONNECTIVITY SOLUTIONS LLP","freshness":"2026-06-19T10:00:00Z","confidence":"high","data_sources":["OT-Intel-DB","Dragos-Threat-Intelligence","DeepSeek-CTI-Analysis"],"waf_rule_hint":"AWS WAF AsnMatchStatement: [215540]","abuse_categories":["bulletproof_hosting","phishing","c2"],"ics_campaign_context":"AS215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) appears in published ICS campaign reporting as preferred ASN for credential theft relay servers targeting industrial sector authentication.","bulletproof_indicator":true,"ics_actor_associations":["SANDWORM","VOLTZITE"],"blocking_recommendation":"BLOCK — no legitimate ICS vendor or operator traffic expected","phishing_kit_associations":["Tycoon2FA","NakedPages","Sneaky2FA"]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_D-_gdASxi5bP0HM5HKNcn","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Profiles an Autonomous System Number (ASN) for ICS/OT threat relevance, including bulletproof hosting indicators, ICS actor associations, abuse categories, and blocking recommendations.","exampleAgentPrompt":"Can you profile ASN AS215540 — I need to know if it's linked to any ICS threat actors like SANDWORM or VOLTZITE, whether it's bulletproof hosting, and if I should block it in my industrial firewall?","exampleUseCases":null,"resultDescription":"Returns a JSON object with the ASN and org name, freshness timestamp, confidence rating, data sources used, abuse categories (e.g. bulletproof_hosting, phishing, c2), ICS campaign context narrative, a boolean bulletproof_indicator, associated ICS threat actors, a plain-English blocking recommendation, associated phishing kits, and a WAF rule hint for firewall automation.","failureModes":["Missing or invalid ASN format returns a validation error","Unknown or low-activity ASNs may return low confidence scores with sparse data","Payment failure via x402/USDC results in 402 response and no data returned","Render.com cold start may cause initial latency spike on first call","Data may lag for very recently registered ASNs not yet in OT-Intel-DB"],"whenToPreferThis":"Use this endpoint when you need OT/ICS-specific ASN reputation — particularly when generic IP/ASN threat feeds lack industrial context. It is the right choice when you need ICS actor attribution (SANDWORM, VOLTZITE), cyber-physical campaign context, or WAF rules tailored to blocking threats to industrial environments, rather than generic abuse scores.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T18:44:32.044Z","isFirstParty":false}