{"uid":"cap_uUCvtJ2UweKOvTKdxVaA-","slug":"ot-intel-api-onrender-com-01af0b9c","name":"OT/ICS IOC Enrichment with Campaign Context","description":"IOC enrichment with ICS campaign context. Pass ?value=1.2.3.4&type=ip or type=domain. Queries AlienVault OTX, AbuseIPDB, and DeepSeek CTI for OT campaign association. Returns verdict on whether the IOC is linked to ICS-targeting campaigns.","url":"https://ot-intel-api.onrender.com/ot/ioc","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["value","type"],"properties":{"type":{"enum":["ip","domain"],"type":"string","description":"IOC type: ip or domain"},"value":{"type":"string","description":"The IOC: IP address or domain name"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"ioc":{"type":"ip","value":"185.220.101.45"},"isp":"Tor Project","tor_node":true,"freshness":"2025-05-22T10:00:00.000Z","reputation":-2,"pulse_count":50,"country_code":"DE","data_sources":["AlienVault-OTX","AbuseIPDB","DeepSeek-CTI-Analysis"],"ics_association":{"confidence":"high","ics_tags_found":["ics","scada","modbus"],"campaign_context":"IP observed in VOLTZITE reconnaissance activity against US electric utilities.","known_threat_actor":"VOLTZITE","associated_with_ics_campaign":true},"total_abuse_reports":142,"abuse_confidence_score":87}},"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"type":"ip","value":"8.8.8.8"}}},"response":{"asn":"AS15169 google llc","ioc":{"type":"ip","value":"8.8.8.8"},"isp":"Google LLC","tor_node":false,"freshness":"2026-06-03T18:13:18.916Z","reputation":0,"pulse_count":0,"country_code":"US","data_sources":["AlienVault-OTX","AbuseIPDB","DeepSeek-CTI-Analysis"],"ics_association":{"confidence":"low","ics_tags_found":[],"campaign_context":"No known OT campaign association","known_threat_actor":null,"associated_with_ics_campaign":false},"no_data_statement":"No threat intelligence found for \"8.8.8.8\" across AlienVault OTX, AbuseIPDB, and DeepSeek CTI analysis. A clean result indicates this IOC is either benign, newly registered, or not yet indexed by public feeds. In an OT context, recommend monitoring rather than immediate blocking — treat as LOW priority unless correlated with other indicators.","total_abuse_reports":117,"abuse_confidence_score":0}},"exampleRequest":{"type":"ip","value":"8.8.8.8"},"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_ENDKQmQ90kKg5JumVh4HD","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Enriches an IP address or domain IOC with OT/ICS-specific threat intelligence, combining AlienVault OTX, AbuseIPDB, and DeepSeek CTI to determine if it is linked to industrial control system targeting campaigns.","exampleAgentPrompt":"Can you check if 185.220.101.45 is linked to any known ICS or OT-targeting campaigns — I need a verdict on whether this IP is a threat to industrial environments, including its abuse confidence score and any ICS threat actor associations.","exampleUseCases":null,"resultDescription":"Returns a structured verdict indicating whether the IOC (IP or domain) is linked to OT-targeting campaigns, including: OT campaign association flag, AlienVault OTX reputation data (pulse count, OT-tagged feeds), AbuseIPDB metrics (abuse confidence score, ISP, Tor node status), and DeepSeek-generated CTI analysis identifying known ICS threat actor associations and campaign context.","failureModes":["Missing required query parameters (value or type not provided) — returns 400 or error message","Invalid IOC type (not 'ip' or 'domain') — may return error or empty result","IOC not found in any upstream source — returns low-confidence or empty verdict","Upstream API (OTX, AbuseIPDB, DeepSeek) unavailability — may return partial or degraded results","Rate limiting or payment failure — returns 402 Payment Required","Render cold start latency — first request may time out if service is sleeping"],"whenToPreferThis":"Choose this endpoint when you need OT/ICS-specific threat context for an IP or domain, not just generic threat scoring. It is uniquely valuable when investigating incidents in industrial environments (energy, utilities, manufacturing) where understanding ICS campaign linkage matters more than raw spam/fraud scores. Prefer this over generic IP reputation APIs when you need ICS threat actor attribution, OT-tagged feed correlation, and campaign context in a single call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T06:41:01.912Z","isFirstParty":false}