ot-intel-api.onrender.com

{
  "_source": "agentic.market",
  "service": {
    "id": "ot-intel-api-onrender-com",
    "name": "ot-intel-api.onrender.com",
    "description": "ICS threat actor ASN infrastructure profiling. Pass ?asn=AS215540. Returns ICS actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, NakedPages), bulletproof hosting indicators, abuse categories (c2, staging, phishing), and an OT-specific blocking recommendation with WAF rule hint. ASN analysis reveals infrastructure clustering that survives IP/domain rotation \u2014 critical for OT defenders tracking persistent actor infrastructure.",
    "domain": "ot-intel-api.onrender.com",
    "provider": "ot-intel-api.onrender.com",
    "providerUrl": "",
    "category": "",
    "networks": [
      "Base"
    ],
    "enriched": false,
    "endpoints": [
      {
        "url": "https://ot-intel-api.onrender.com/ot/actor",
        "description": "ICS threat actor profile. Pass ?name=SANDWORM. Returns MITRE ATT&CK ICS techniques, known malware, attribution, physical impact, targeted sectors, and OT detection recommendations. Alias lookup supported: Volt Typhoon\u2192VOLTZITE, APT44\u2192SANDWORM. Covers all Dragos Activity Groups.",
        "pricing": {
          "amount": "0.03",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "name",
            "type": "string",
            "description": "",
            "example": "SANDWORM",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "35",
          "l30DaysUniquePayers": "7"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/actor/sector",
        "description": "ICS threat actors by sector. Pass ?sector=energy. Returns all groups targeting that sector from live MITRE ATT&CK ICS STIX data. Covers energy, water, manufacturing, oil-and-gas, chemical, transportation, nuclear.",
        "pricing": {
          "amount": "0.03",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "sector",
            "type": "string",
            "description": "",
            "example": "energy",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "24",
          "l30DaysUniquePayers": "6"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/advisory",
        "description": "Live CISA ICS-CERT advisories filtered by vendor or sector. Pass ?vendor=siemens or ?sector=energy. Returns advisory IDs, CVSS scores, CVE lists, OT severity, and sector tags. Up to 25 results.",
        "pricing": {
          "amount": "0.02",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "limit",
            "type": "string",
            "description": "",
            "example": "10",
            "enumValues": [],
            "default": null,
            "required": false
          },
          {
            "group": "query",
            "name": "sector",
            "type": "string",
            "description": "",
            "example": "energy",
            "enumValues": [],
            "default": null,
            "required": false
          },
          {
            "group": "query",
            "name": "vendor",
            "type": "string",
            "description": "",
            "example": "siemens",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "28",
          "l30DaysUniquePayers": "6"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/article",
        "description": "Publication-ready CTI article ~700 words. Pass ?actor=CHERNOVITE or ?cve=CVE-XXXX-XXXX. Fans out to actor/cve + campaign + malware + advisory. DeepSeek writes journalist-style: headline, lede, body with ATT&CK context, defanged IOCs, analyst assessment, TLP. Ready for threat intel blog or advisory publication.",
        "pricing": {
          "amount": "0.45",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "actor",
            "type": "string",
            "description": "",
            "example": "CHERNOVITE",
            "enumValues": [],
            "default": null,
            "required": false
          },
          {
            "group": "query",
            "name": "sector",
            "type": "string",
            "description": "",
            "example": "energy",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "7",
          "l30DaysUniquePayers": "6"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/asn",
        "description": "ICS threat actor ASN infrastructure profiling. Pass ?asn=AS215540. Returns ICS actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, NakedPages), bulletproof hosting indicators, abuse categories (c2, staging, phishing), and an OT-specific blocking recommendation with WAF rule hint. ASN analysis reveals infrastructure clustering that survives IP/domain rotation \u2014 critical for OT defenders tracking persistent actor infrastructure.",
        "pricing": {
          "amount": "0.03",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "asn",
            "type": "string",
            "description": "",
            "example": "AS215540",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "7",
          "l30DaysUniquePayers": "5"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/brief",
        "description": "Sector threat brief for ICS/OT. Pass ?sector=energy&period=30. Returns active actors, new CVE counts, active campaigns, top advisories, and risk_trend (increasing/stable/decreasing). One call replaces 5+ chained calls. Ideal for weekly reporting and compliance dashboards.",
        "pricing": {
          "amount": "0.1",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "period",
            "type": "string",
            "description": "",
            "example": "30",
            "enumValues": [],
            "default": null,
            "required": false
          },
          {
            "group": "query",
            "name": "sector",
            "type": "string",
            "description": "",
            "example": "energy",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "24",
          "l30DaysUniquePayers": "7"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/campaign",
        "description": "Active ICS campaign tracker. Pass ?sector=electric&status=active. Returns campaigns currently targeting a sector with actor attribution, start date, targeted geography, TTPs in use, and CVEs being exploited. No free equivalent for live campaign status.",
        "pricing": {
          "amount": "0.05",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "sector",
            "type": "string",
            "description": "",
            "example": "electric",
            "enumValues": [],
            "default": null,
            "required": false
          },
          {
            "group": "query",
            "name": "status",
            "type": "string",
            "description": "",
            "example": "active",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "21",
          "l30DaysUniquePayers": "7"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/compliance",
        "description": "NERC CIP and IEC 62443 compliance gap mapping for a CVE or threat actor. Pass ?cve_id=CVE-2023-38802 or ?actor=SANDWORM&framework=nerc_cip. Returns triggered controls by framework (CIP-007-6 R2, SR 5.1, etc.), status (NON_COMPLIANT_IF_UNMITIGATED / REVIEW_REQUIRED), required action, and compensating controls. Designed for automated compliance reporting agents running on cron: call when a new advisory drops, generate gap report, route to compliance team.",
        "pricing": {
          "amount": "0.04",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "cve_id",
            "type": "string",
            "description": "",
            "example": "CVE-2023-38802",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "12",
          "l30DaysUniquePayers": "5"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/cve",
        "description": "OT-contextualised CVE triage for ICS/SCADA. Pass ?id=CVE-XXXX-XXXX. Returns OT-adjusted severity, cyber-physical impact, patch feasibility, CISA KEV status, and prioritised action. DeepSeek-enriched with live NVD and CISA-KEV data.",
        "pricing": {
          "amount": "0.02",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "id",
            "type": "string",
            "description": "",
            "example": "CVE-2023-38802",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "30",
          "l30DaysUniquePayers": "8"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/delta",
        "description": "ICS sector change feed \u2014 only what is NEW in the last N days. Pass ?sector=water&days=7. Returns new CVEs, new CISA advisories, and new actor activity since the last call. Designed for cron-based monitoring agents. Eliminates redundant reprocessing.",
        "pricing": {
          "amount": "0.03",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "days",
            "type": "string",
            "description": "",
            "example": "7",
            "enumValues": [],
            "default": null,
            "required": false
          },
          {
            "group": "query",
            "name": "sector",
            "type": "string",
            "description": "",
            "example": "water",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "26",
          "l30DaysUniquePayers": "7"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/detection",
        "description": "ICS detection artifact retrieval. Pass ?target=PIPEDREAM or ?target=SANDWORM&format=sigma. Returns YARA/Sigma rules for the target malware or actor, sourced from public corpus (Florian Roth signature-base, CISA advisories) with validated:true, or DeepSeek-synthesised with validated:false. Designed for automated threat hunting pipelines that commit rules to SIEMs and EDRs \u2014 validated:true rules are safe to deploy; validated:false require lab testing first.",
        "pricing": {
          "amount": "0.05",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "target",
            "type": "string",
            "description": "",
            "example": "PIPEDREAM",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "10",
          "l30DaysUniquePayers": "6"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/device",
        "description": "ICS/OT device exposure lookup. Pass ?vendor=siemens&model=s7-1200. Returns default credential risk, exposed OT protocols (Modbus/502, S7comm/102, DNP3/20000), exploitation notes, and hardening steps. Covers Siemens, Schneider, Rockwell, Honeywell, GE, Unitronics, Beckhoff.",
        "pricing": {
          "amount": "0.05",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "model",
            "type": "string",
            "description": "",
            "example": "vision",
            "enumValues": [],
            "default": null,
            "required": false
          },
          {
            "group": "query",
            "name": "vendor",
            "type": "string",
            "description": "",
            "example": "unitronics",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "30",
          "l30DaysUniquePayers": "7"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/dossier",
        "description": "Deep actor intelligence dossier. Pass ?actor=SANDWORM. Fans out to actor, campaign, malware, ioc, asn, detection primitives and synthesises via DeepSeek. Returns full profile, infrastructure, IOC table, detection rules, kill chain mapping. Most comprehensive single-call artifact available.",
        "pricing": {
          "amount": "0.35",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "actor",
            "type": "string",
            "description": "",
            "example": "SANDWORM",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "7",
          "l30DaysUniquePayers": "5"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/exposure",
        "description": "OT asset risk verdict. Pass ?vendor=siemens&model=s7-1500&sector=energy&network=internet-facing. Returns risk_score (0-100), risk_level, escalate (boolean), recommended_action, active CVEs, and threat actors. Optional firmware param enables firmware-specific CVE matching. Cached 1 hour.",
        "pricing": {
          "amount": "0.05",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "model",
            "type": "string",
            "description": "",
            "example": "s7-1500",
            "enumValues": [],
            "default": null,
            "required": false
          },
          {
            "group": "query",
            "name": "network",
            "type": "string",
            "description": "",
            "example": "internet-facing",
            "enumValues": [],
            "default": null,
            "required": false
          },
          {
            "group": "query",
            "name": "sector",
            "type": "string",
            "description": "",
            "example": "energy",
            "enumValues": [],
            "default": null,
            "required": false
          },
          {
            "group": "query",
            "name": "vendor",
            "type": "string",
            "description": "",
            "example": "siemens",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "19",
          "l30DaysUniquePayers": "7"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/ioc",
        "description": "IOC enrichment with ICS campaign context. Pass ?value=1.2.3.4&type=ip or type=domain. Queries AlienVault OTX, AbuseIPDB, and DeepSeek CTI for OT campaign association. Returns verdict on whether the IOC is linked to ICS-targeting campaigns.",
        "pricing": {
          "amount": "0.01",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "type",
            "type": "string",
            "description": "",
            "example": "ip",
            "enumValues": [],
            "default": null,
            "required": false
          },
          {
            "group": "query",
            "name": "value",
            "type": "string",
            "description": "",
            "example": "185.220.101.45",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "35",
          "l30DaysUniquePayers": "7"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/linkedin",
        "description": "LinkedIn post for CTI/ICS security audience. Pass ?actor=VOLTZITE or ?cve=CVE-XXXX-XXXX. Fans out to actor or cve + advisory. Returns hook line, 3-5 intelligence bullets, call to action, hashtags. Ready to publish. Ideal for security practitioners and threat intelligence teams sharing findings.",
        "pricing": {
          "amount": "0.15",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "actor",
            "type": "string",
            "description": "",
            "example": "VOLTZITE",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "7",
          "l30DaysUniquePayers": "5"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/malware",
        "description": "ICS malware encyclopedia. Pass ?name=PIPEDREAM. Returns capabilities, targeted OT protocols, attributed actor, affected vendors, detection signatures, and MITRE ATT&CK ICS techniques. Covers PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY.",
        "pricing": {
          "amount": "0.02",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "name",
            "type": "string",
            "description": "",
            "example": "PIPEDREAM",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "18",
          "l30DaysUniquePayers": "7"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/patch",
        "description": "OT/ICS patch feasibility for a CVE. Pass ?id=CVE-XXXX-XXXX. Returns patch availability, OT-safe workarounds, patch complexity per ICS layer, estimated downtime, safe-to-patch-live flag, deployment strategy, and risk-vs-disruption score 1-10.",
        "pricing": {
          "amount": "0.05",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "id",
            "type": "string",
            "description": "",
            "example": "CVE-2021-34527",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "28",
          "l30DaysUniquePayers": "6"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/report",
        "description": "Synthesised Markdown threat actor report for ICS/OT. Pass ?actor=CHERNOVITE&sector=energy. Fans out to actor, campaign, malware, advisory, detection primitives internally (no extra charge) and synthesises via DeepSeek. Returns executive summary, TTPs, campaigns, malware, recommended actions. TLP: WHITE.",
        "pricing": {
          "amount": "0.25",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "actor",
            "type": "string",
            "description": "",
            "example": "CHERNOVITE",
            "enumValues": [],
            "default": null,
            "required": false
          },
          {
            "group": "query",
            "name": "sector",
            "type": "string",
            "description": "",
            "example": "energy",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "8",
          "l30DaysUniquePayers": "6"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/sitrep",
        "description": "Sector situation report. Pass ?sector=energy&period=30. Fans out to actor/sector, advisory, campaign, delta, compliance primitives. Returns 30-day threat landscape, top actors, new advisories, what changed, compliance posture, recommended priorities. Designed for weekly security briefing automation.",
        "pricing": {
          "amount": "0.35",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "period",
            "type": "string",
            "description": "",
            "example": "30",
            "enumValues": [],
            "default": null,
            "required": false
          },
          {
            "group": "query",
            "name": "sector",
            "type": "string",
            "description": "",
            "example": "energy",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "7",
          "l30DaysUniquePayers": "5"
        }
      },
      {
        "url": "https://ot-intel-api.onrender.com/ot/xpost",
        "description": "X/Twitter thread (5-7 posts) for an ICS actor or CVE. Pass ?actor=XENOTIME or ?cve=CVE-XXXX-XXXX. Fans out to actor or cve. Returns thread array: hook post, intel posts with ATT&CK IDs and affected OT systems, mitigation post, hashtag post. Each post under 280 characters.",
        "pricing": {
          "amount": "0.1",
          "currency": "USDC",
          "network": "eip155:8453",
          "scheme": "exact",
          "maxAmount": "",
          "minAmount": ""
        },
        "method": "GET",
        "providerName": "",
        "parameters": [
          {
            "group": "query",
            "name": "actor",
            "type": "string",
            "description": "",
            "example": "XENOTIME",
            "enumValues": [],
            "default": null,
            "required": false
          }
        ],
        "serviceName": "",
        "tags": [],
        "quality": {
          "l30DaysTotalCalls": "7",
          "l30DaysUniquePayers": "6"
        }
      }
    ],
    "integrationType": "",
    "isNew": false,
    "priceSummary": {
      "minAmount": "0.01",
      "maxAmount": "0.45",
      "avgCostPerTransaction": "0.10619",
      "avgCostBasis": "exact",
      "currency": "USDC"
    },
    "serviceName": "",
    "tags": [],
    "iconUrl": ""
  }
}