●

OT Intel API

Data PAYMENT-READY imported

payment-ready until 2026-08-20

imported from the x402 Bazaar, not submitted by the operator · own this service? claim it · or ask to be removed

Pay-per-call OT/ICS threat intelligence API. Endpoints cover CVE triage with OT-adjusted severity, internet-exposed device lookup, threat actor and campaign profiles, IOC enrichment, detection artifacts and compliance framework mapping. Responses are LLM-enriched. Priced in USDC on Base.

Pay from $0.01 to $0.10 per request in USDC on Base, settled onchain via the x402 protocol, no signup, no API key needed.

first settlement 2026-05-21 · $36.65 all-time · settled via coinbase

BASE URL https://ot-intel-api.onrender.com │ ENDPOINTS 10 │ NETWORK Base │ ASSET USDC │ MEMBER SINCE 2026-07-20 │ MONITORED SINCE 2026-07-20

ASSESSMENT

updated 4h ago

Evidence-backed signals, not a single score. Click any chip for the proof. Measured values stay read-only; unknown is honest.

reliability 100%

uptime 24h: 100%
uptime 7d: 100%
uptime 30d: 100%
uptime 90d: 100%
response p95: 404ms
avg response: 221ms
total checks: 2,135

Measured on the unpaid 402 handshake, not the paid call. A service can 402 correctly and still fail after payment.

compliance A (14/14)

14 of 14 x402 conformance checks pass. Full checklist below.

jump to compliance checklist

price $0.01 to $0.10 (p53 in Data)

price (min): $0.01
price (max): $0.10
category percentile (min): p53 in Data
category percentile (max): p77 in Data
endpoints / prices: 10 / 6
model: tiered
stability: 100%

risk clean

No deterministic risk flag. Risk fires only on an exact blocklist match, or a reserved-brand name with a mismatched verified payTo. Never from low uptime, a high price, or a model guess.

domain age: -
registrar: -
hosting: free host
domain created: ---

Identity facts, not a risk score.

traction $27.14 30d · 8 buyers

volume 30d: $27.14
buyers 30d: 8
settlements 30d: 250
first settlement: 2026-05-21
last settlement: 2026-08-13
top buyer share: 76% of 30d volume
trend 7d vs 30d: 0.33x the 30d daily rate
networks: eip155:8453
volume all-time: $36.65
settlements all-time: 389
median settlement 30d: $0.05
max settlement 30d: $0.45
settled via: coinbase ($27.14, 250 tx)

Conservative undercount: only USDC settlements via facilitators we measure are counted. A measured floor, not an estimate.

Top buyer share is a concentration signal, not part of the ranking score.

WHAT IT DOES

ai-derived

Provides OT/ICS/SCADA threat intelligence for AI agents and industrial SOC automation

category: threat-intelligence

threat-intelligencecybersecurityot-ics-scadacve-triagedevice-lookupactor-profilesioc-enrichmentcampaign-tracking

AI-generated summary. The measured data is never altered by it.

ENDPOINTS

Service endpoints with HTTP method, path, description, pricing, and network
METHOD	PATH	PRICE	NETWORK	ASSET	402 CHANNEL
GET	/ot/actor/sector	$0.03	Base	USDC	header
GET	/ot/brief	$0.10	Base	USDC	header
GET	/ot/campaign	$0.05	Base	USDC	header
GET	/ot/compliance	$0.04	Base	USDC	header
GET	/ot/cve	$0.02	Base	USDC	header
GET	/ot/delta	$0.03	Base	USDC	header
GET	/ot/detection	$0.05	Base	USDC	header
GET	/ot/device	$0.05	Base	USDC	header
GET	/ot/exposure	$0.05	Base	USDC	header
GET	/ot/ioc	$0.01	Base	USDC	header

10 endpoints

REQUEST / RESPONSE EXAMPLE

An unpaid request to GET /ot/actor/sector returns HTTP 402 with the payment terms. Settle onchain via your facilitator, then retry with the X-Payment header.

// request

curl -i 'https://ot-intel-api.onrender.com/ot/actor/sector'

// 402 response (captured by monitor) · 10 payloads · click to expand

[
  {
    "error": "Payment required",
    "accepts": [
      {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
        "amount": "20000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      }
    ],
    "resource": {
      "url": "https://ot-intel-api.onrender.com/ot/cve",
      "mimeType": "application/json",
      "description": "OT-contextualised CVE triage for ICS/SCADA. Pass ?id=CVE-XXXX-XXXX. Returns OT-adjusted severity, cyber-physical impact, patch feasibility, CISA KEV status, and prioritised action. DeepSeek-enriched with live NVD and CISA-KEV data."
    },
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "type": "http",
            "method": "GET",
            "queryParams": {
              "id": "CVE-2023-38802"
            }
          },
          "output": {
            "type": "json",
            "example": {
              "cve_id": "CVE-2019-13945",
              "summary": "A vulnerability has been identified in SIMATIC S7-1200 CPU family (All versions). The web server of the affected devices transmits data without TLS encryption.",
              "freshness": "2025-05-22T10:00:00.000Z",
              "cvss_score": 6.8,
              "ot_context": {
                "affected_layer": "field_device",
                "patch_feasibility": "low — requires maintenance window",
                "safety_system_risk": true,
                "production_downtime": true,
                "ot_adjusted_severity": "high"
              },
              "data_sources": [
                "NVD",
                "CISA-KEV",
                "DeepSeek-CTI-Analysis"
              ],
              "kev_due_date": null,
              "actively_exploited": false,
              "recommended_action": "HIGH: Schedule patch for next maintenance window.",
              "compensating_controls": [
                "Isolate PLC from IT network via VLAN",
                "Disable web server interface if unused",
                "Deploy unidirectional gateway for historian traffic"
              ]
            }
          }
        },
        "schema": {
          "type": "object",
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "required": [
            "input"
          ],
          "properties": {
            "input": {
              "type": "object",
              "required": [
                "type",
                "method"
              ],
              "properties": {
                "type": {
                  "type": "string",
                  "const": "http"
                },
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "type": "object",
                  "required": [
                    "id"
                  ],
                  "properties": {
                    "id": {
                      "type": "string",
                      "description": "CVE identifier e.g. CVE-2023-38802"
                    }
                  }
                }
              },
              "additionalProperties": false
            },
            "output": {
              "type": "object",
              "required": [
                "type"
              ],
              "properties": {
                "type": {
                  "type": "string"
                },
                "example": {
                  "type": "object"
                }
              }
            }
          }
        }
      }
    },
    "x402Version": 2
  },
  {
    "error": "Payment required",
    "accepts": [
      {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
        "amount": "50000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      }
    ],
    "resource": {
      "url": "https://ot-intel-api.onrender.com/ot/detection",
      "mimeType": "application/json",
      "description": "ICS detection artifact retrieval. Pass ?target=PIPEDREAM or ?target=SANDWORM&format=sigma. Returns YARA/Sigma rules for the target malware or actor, sourced from public corpus (Florian Roth signature-base, CISA advisories) with validated:true, or DeepSeek-synthesised with validated:false. Designed for automated threat hunting pipelines that commit rules to SIEMs and EDRs — validated:true rules are safe to deploy; validated:false require lab testing first."
    },
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "type": "http",
            "method": "GET",
            "queryParams": {
              "target": "PIPEDREAM"
            }
          },
          "output": {
            "type": "json",
            "example": {
              "target": "PIPEDREAM",
              "freshness": "2026-06-19T10:00:00Z",
              "signatures": [
                {
                  "type": "YARA",
                  "source": "manual",
                  "raw_rule": "rule PIPEDREAM_INCONTROLLER_Loader { meta: ... strings: ... condition: ... }",
                  "rule_name": "PIPEDREAM_INCONTROLLER_Loader",
                  "validated": false,
                  "ot_safe_note": "Synthesised from CISA advisory AA22-103A. Test against OT baseline before SIEM deployment.",
                  "target_layer": "engineering_workstation"
                }
              ],
              "data_sources": [
                "OT-Intel-DB",
                "DeepSeek-CTI-Analysis"
              ],
              "artifact_type": "malware",
              "validated_count": 0,
              "synthesised_count": 1,
              "ot_safe_validation": "0 of 1 rules sourced from public corpus. Rules with validated:false require lab testing before production deployment."
            }
          }
        },
        "schema": {
          "type": "object",
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "required": [
            "input"
          ],
          "properties": {
            "input": {
              "type": "object",
              "required": [
                "type",
                "method"
              ],
              "properties": {
                "type": {
                  "type": "string",
                  "const": "http"
                },
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "type": "object",
                  "required": [
                    "target"
                  ],
                  "properties": {
                    "format": {
                      "type": "string",
                      "description": "Rule format: yara | sigma | snort | all (default: all)"
                    },
                    "target": {
                      "type": "string",
                      "description": "Malware or actor name e.g. PIPEDREAM, INDUSTROYER2, TRITON, SANDWORM, CHERNOVITE"
                    }
                  }
                }
              },
              "additionalProperties": false
            },
            "output": {
              "type": "object",
              "required": [
                "type"
              ],
              "properties": {
                "type": {
                  "type": "string"
                },
                "example": {
                  "type": "object"
                }
              }
            }
          }
        }
      }
    },
    "x402Version": 2
  },
  {
    "error": "Payment required",
    "accepts": [
      {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
        "amount": "50000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      }
    ],
    "resource": {
      "url": "https://ot-intel-api.onrender.com/ot/campaign",
      "mimeType": "application/json",
      "description": "Active ICS campaign tracker. Pass ?sector=electric&status=active. Returns campaigns currently targeting a sector with actor attribution, start date, targeted geography, TTPs in use, and CVEs being exploited. No free equivalent for live campaign status."
    },
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "type": "http",
            "method": "GET",
            "queryParams": {
              "sector": "electric",
              "status": "active"
            }
          },
          "output": {
            "type": "json",
            "example": {
              "sector": "electric",
              "status": "active",
              "campaigns": [
                {
                  "name": "VOLTZITE Pre-Positioning Campaign",
                  "actor": "VOLTZITE",
                  "status": "active",
                  "confidence": "high",
                  "start_date": "2023-Q1",
                  "ttps_in_use": [
                    "T0859",
                    "T0812",
                    "T0885"
                  ],
                  "exploited_cves": [
                    "CVE-2023-38380"
                  ],
                  "targeted_geography": [
                    "United States",
                    "Pacific Islands"
                  ]
                }
              ],
              "freshness": "2026-06-13T10:00:00Z",
              "data_sources": [
                "MITRE-ATT&CK-ICS",
                "CISA-ICS-CERT",
                "OT-Intel-DB",
                "DeepSeek-CTI-Analysis"
              ],
              "campaign_count": 2
            }
          }
        },
        "schema": {
          "type": "object",
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "required": [
            "input"
          ],
          "properties": {
            "input": {
              "type": "object",
              "required": [
                "type",
                "method"
              ],
              "properties": {
                "type": {
                  "type": "string",
                  "const": "http"
                },
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "type": "object",
                  "required": [
                    "sector"
                  ],
                  "properties": {
                    "sector": {
                      "type": "string",
                      "description": "Industrial sector e.g. energy, water, electric, manufacturing, oil-and-gas, nuclear, chemical"
                    },
                    "status": {
                      "type": "string",
                      "description": "active (default) | all"
                    }
                  }
                }
              },
              "additionalProperties": false
            },
            "output": {
              "type": "object",
              "required": [
                "type"
              ],
              "properties": {
                "type": {
                  "type": "string"
                },
                "example": {
                  "type": "object"
                }
              }
            }
          }
        }
      }
    },
    "x402Version": 2
  },
  {
    "error": "Payment required",
    "accepts": [
      {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
        "amount": "50000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      }
    ],
    "resource": {
      "url": "https://ot-intel-api.onrender.com/ot/device",
      "mimeType": "application/json",
      "description": "ICS/OT device exposure lookup. Pass ?vendor=siemens&model=s7-1200. Returns default credential risk, exposed OT protocols (Modbus/502, S7comm/102, DNP3/20000), exploitation notes, and hardening steps. Covers Siemens, Schneider, Rockwell, Honeywell, GE, Unitronics, Beckhoff."
    },
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "type": "http",
            "method": "GET",
            "queryParams": {
              "model": "vision",
              "vendor": "unitronics"
            }
          },
          "output": {
            "type": "json",
            "example": {
              "query": {
                "model": "vision",
                "vendor": "unitronics"
              },
              "freshness": "2025-05-22T10:00:00.000Z",
              "data_sources": [
                "NVD",
                "CISA-ICS-CERT",
                "DeepSeek-CTI-Analysis"
              ],
              "recommended_action": "Change default credentials immediately. No downtime required.",
              "ot_protocols_at_risk": [
                "PCOM (20256)",
                "Modbus TCP (502)"
              ],
              "default_credential_risk": {
                "note": "Default password 1111 on port 20256. Actively exploited by IRGC 2023–2024.",
                "risk": "critical"
              }
            }
          }
        },
        "schema": {
          "type": "object",
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "required": [
            "input"
          ],
          "properties": {
            "input": {
              "type": "object",
              "required": [
                "type",
                "method"
              ],
              "properties": {
                "type": {
                  "type": "string",
                  "const": "http"
                },
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "type": "object",
                  "required": [
                    "vendor",
                    "model"
                  ],
                  "properties": {
                    "model": {
                      "type": "string",
                      "description": "Model or product line e.g. s7-1200, quantum, logix, vision"
                    },
                    "vendor": {
                      "type": "string",
                      "description": "Vendor name e.g. siemens, schneider, rockwell, honeywell, unitronics, ge, beckhoff"
                    }
                  }
                }
              },
              "additionalProperties": false
            },
            "output": {
              "type": "object",
              "required": [
                "type"
              ],
              "properties": {
                "type": {
                  "type": "string"
                },
                "example": {
                  "type": "object"
                }
              }
            }
          }
        }
      }
    },
    "x402Version": 2
  },
  {
    "error": "Payment required",
    "accepts": [
      {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
        "amount": "50000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      }
    ],
    "resource": {
      "url": "https://ot-intel-api.onrender.com/ot/exposure",
      "mimeType": "application/json",
      "description": "OT asset risk verdict. Pass ?vendor=siemens&model=s7-1500&sector=energy&network=internet-facing. Returns risk_score (0-100), risk_level, escalate (boolean), recommended_action, active CVEs, and threat actors. Optional firmware param enables firmware-specific CVE matching. Cached 1 hour."
    },
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "type": "http",
            "method": "GET",
            "queryParams": {
              "model": "s7-1500",
              "sector": "energy",
              "vendor": "siemens",
              "network": "internet-facing"
            }
          },
          "output": {
            "type": "json",
            "example": {
              "model": "s7-1500",
              "sector": "energy",
              "vendor": "siemens",
              "network": "internet-facing",
              "escalate": true,
              "freshness": "2026-06-13T10:00:00Z",
              "confidence": "high",
              "risk_level": "critical",
              "risk_score": 87,
              "top_threat": "VOLTZITE pre-positioning via CVE-2023-38380",
              "active_cves": 3,
              "ttl_seconds": 3600,
              "data_sources": [
                "NVD",
                "CISA-KEV",
                "MITRE-ATT&CK-ICS",
                "DeepSeek-CTI-Analysis"
              ],
              "threat_actors": [
                "VOLTZITE",
                "SANDWORM"
              ],
              "active_campaigns": 2,
              "recommended_action": "isolate"
            }
          }
        },
        "schema": {
          "type": "object",
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "required": [
            "input"
          ],
          "properties": {
            "input": {
              "type": "object",
              "required": [
                "type",
                "method"
              ],
              "properties": {
                "type": {
                  "type": "string",
                  "const": "http"
                },
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "type": "object",
                  "required": [
                    "vendor",
                    "model",
                    "sector",
                    "network"
                  ],
                  "properties": {
                    "model": {
                      "type": "string",
                      "description": "Device model e.g. s7-1500, modicon-m340, controllogix"
                    },
                    "sector": {
                      "type": "string",
                      "description": "Industrial sector e.g. energy, water, manufacturing, oil-and-gas"
                    },
                    "vendor": {
                      "type": "string",
                      "description": "Vendor name e.g. siemens, schneider, rockwell, ge, honeywell"
                    },
                    "network": {
                      "type": "string",
                      "description": "Network exposure: internet-facing | dmz | lan-only | air-gapped"
                    },
                    "firmware": {
                      "type": "string",
                      "description": "Firmware version e.g. 2.9.2 (optional — enables firmware-specific CVE matching)"
                    }
                  }
                }
              },
              "additionalProperties": false
            },
            "output": {
              "type": "object",
              "required": [
                "type"
              ],
              "properties": {
                "type": {
                  "type": "string"
                },
                "example": {
                  "type": "object"
                }
              }
            }
          }
        }
      }
    },
    "x402Version": 2
  },
  {
    "error": "Payment required",
    "accepts": [
      {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
        "amount": "30000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      }
    ],
    "resource": {
      "url": "https://ot-intel-api.onrender.com/ot/actor/sector",
      "mimeType": "application/json",
      "description": "ICS threat actors by sector. Pass ?sector=energy. Returns all groups targeting that sector from live MITRE ATT&CK ICS STIX data. Covers energy, water, manufacturing, oil-and-gas, chemical, transportation, nuclear."
    },
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "type": "http",
            "method": "GET",
            "queryParams": {
              "sector": "energy"
            }
          },
          "output": {
            "type": "json",
            "example": {
              "count": 2,
              "query": {
                "sector": "energy"
              },
              "freshness": "2025-05-22T10:00:00.000Z",
              "data_sources": [
                "MITRE-ATT&CK-ICS",
                "DeepSeek-CTI-Analysis"
              ],
              "actors_targeting_sector": [
                {
                  "name": "SANDWORM",
                  "attribution": "Russia — GRU Unit 74455",
                  "activity_status": "ACTIVE",
                  "physical_impact": "CONFIRMED DESTRUCTIVE"
                },
                {
                  "name": "VOLTZITE",
                  "attribution": "China",
                  "activity_status": "ACTIVE",
                  "physical_impact": "LIKELY"
                }
              ]
            }
          }
        },
        "schema": {
          "type": "object",
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "required": [
            "input"
          ],
          "properties": {
            "input": {
              "type": "object",
              "required": [
                "type",
                "method"
              ],
              "properties": {
                "type": {
                  "type": "string",
                  "const": "http"
                },
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "type": "object",
                  "required": [
                    "sector"
                  ],
                  "properties": {
                    "sector": {
                      "type": "string",
                      "description": "Industry sector e.g. energy, water, manufacturing, oil-and-gas, chemical, transportation, nuclear"
                    }
                  }
                }
              },
              "additionalProperties": false
            },
            "output": {
              "type": "object",
              "required": [
                "type"
              ],
              "properties": {
                "type": {
                  "type": "string"
                },
                "example": {
                  "type": "object"
                }
              }
            }
          }
        }
      }
    },
    "x402Version": 2
  },
  {
    "error": "Payment required",
    "accepts": [
      {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
        "amount": "40000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      }
    ],
    "resource": {
      "url": "https://ot-intel-api.onrender.com/ot/compliance",
      "mimeType": "application/json",
      "description": "Compliance gap mapping for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443, NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, UAE NESA IA. Pass ?cve_id=CVE-2023-38802 or ?actor=SANDWORM, optionally &framework=<value> to filter. Returns triggered controls (e.g. CIP-007-6 R2, IEC 62443-3-3 SR 5.1), status (NON_COMPLIANT_IF_UNMITIGATED / REVIEW_REQUIRED), required action, and compensating controls. For automated compliance reporting agents on cron."
    },
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "type": "http",
            "method": "GET",
            "queryParams": {
              "cve_id": "CVE-2023-38802"
            }
          },
          "output": {
            "type": "json",
            "example": {
              "cve_id": "CVE-2023-38802",
              "query_id": "CVE-2023-38802",
              "freshness": "2026-06-19T10:00:00Z",
              "frameworks": {
                "nerc_cip": [
                  {
                    "title": "Security Patch Management",
                    "status": "NON_COMPLIANT_IF_UNMITIGATED",
                    "control": "CIP-007-6 R2",
                    "action_required": "Evaluate CVE-2023-38802 within 35 days of CISA KEV listing.",
                    "compensating_control": "Network segmentation restricting BGP traffic to SCADA DMZ pending patch."
                  }
                ],
                "iec_62443_3_3": [
                  {
                    "status": "NON_COMPLIANT_IF_UNMITIGATED",
                    "component": "3-3 SR 5.1",
                    "requirement": "Network Segmentation",
                    "compensating_control": "Enforce zone conduits: restrict BGP/ICS protocol traffic to whitelisted source/destination pairs."
                  }
                ]
              },
              "data_sources": [
                "OT-Intel-DB-Compliance",
                "DeepSeek-CTI-Analysis"
              ],
              "priority_action": "Apply network segmentation at the ESP boundary immediately; schedule CVE patch for next maintenance window.",
              "controls_triggered": 2
            }
          }
        },
        "schema": {
          "type": "object",
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "required": [
            "input"
          ],
          "properties": {
            "input": {
              "type": "object",
              "required": [
                "type",
                "method"
              ],
              "properties": {
                "type": {
                  "type": "string",
                  "const": "http"
                },
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "type": "object",
                  "required": [],
                  "properties": {
                    "actor": {
                      "type": "string",
                      "description": "Threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME — triggers actor-specific control mappings. At least one of cve_id or actor is required."
                    },
                    "cve_id": {
                      "type": "string",
                      "description": "CVE identifier e.g. CVE-2023-38802 — triggers CVE-specific control mappings. At least one of cve_id or actor is required."
                    },
                    "framework": {
                      "type": "string",
                      "description": "Optional filter to one compliance framework. Valid values: nerc_cip, iec_62443_2_1, iec_62443_2_4, iec_62443_3_2, iec_62443_3_3, iec_62443_4_2, nist_800_82, nist_csf, cisa_cpg, nca_otcc, uae_nesa_ia. Omit (or pass 'all') to return matches across every framework."
                    }
                  }
                }
              },
              "additionalProperties": false
            },
            "output": {
              "type": "object",
              "required": [
                "type"
              ],
              "properties": {
                "type": {
                  "type": "string"
                },
                "example": {
                  "type": "object"
                }
              }
            }
          }
        }
      }
    },
    "x402Version": 2
  },
  {
    "error": "Payment required",
    "accepts": [
      {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
        "amount": "10000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      }
    ],
    "resource": {
      "url": "https://ot-intel-api.onrender.com/ot/ioc",
      "mimeType": "application/json",
      "description": "IOC enrichment with ICS campaign context. Pass ?value=1.2.3.4&type=ip or type=domain. Queries AlienVault OTX, AbuseIPDB, and DeepSeek CTI for OT campaign association. Returns verdict on whether the IOC is linked to ICS-targeting campaigns."
    },
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "type": "http",
            "method": "GET",
            "queryParams": {
              "type": "ip",
              "value": "185.220.101.45"
            }
          },
          "output": {
            "type": "json",
            "example": {
              "ioc": {
                "type": "ip",
                "value": "185.220.101.45"
              },
              "isp": "Tor Project",
              "tor_node": true,
              "freshness": "2025-05-22T10:00:00.000Z",
              "reputation": -2,
              "pulse_count": 50,
              "country_code": "DE",
              "data_sources": [
                "AlienVault-OTX",
                "AbuseIPDB",
                "DeepSeek-CTI-Analysis"
              ],
              "ics_association": {
                "confidence": "high",
                "ics_tags_found": [
                  "ics",
                  "scada",
                  "modbus"
                ],
                "campaign_context": "IP observed in VOLTZITE reconnaissance activity against US electric utilities.",
                "known_threat_actor": "VOLTZITE",
                "associated_with_ics_campaign": true
              },
              "total_abuse_reports": 142,
              "abuse_confidence_score": 87
            }
          }
        },
        "schema": {
          "type": "object",
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "required": [
            "input"
          ],
          "properties": {
            "input": {
              "type": "object",
              "required": [
                "type",
                "method"
              ],
              "properties": {
                "type": {
                  "type": "string",
                  "const": "http"
                },
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "type": "object",
                  "required": [
                    "value",
                    "type"
                  ],
                  "properties": {
                    "type": {
                      "enum": [
                        "ip",
                        "domain"
                      ],
                      "type": "string",
                      "description": "IOC type: ip or domain"
                    },
                    "value": {
                      "type": "string",
                      "description": "The IOC: IP address or domain name"
                    }
                  }
                }
              },
              "additionalProperties": false
            },
            "output": {
              "type": "object",
              "required": [
                "type"
              ],
              "properties": {
                "type": {
                  "type": "string"
                },
                "example": {
                  "type": "object"
                }
              }
            }
          }
        }
      }
    },
    "x402Version": 2
  },
  {
    "error": "Payment required",
    "accepts": [
      {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
        "amount": "100000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      }
    ],
    "resource": {
      "url": "https://ot-intel-api.onrender.com/ot/brief",
      "mimeType": "application/json",
      "description": "Sector threat brief for ICS/OT. Pass ?sector=energy&period=30. Returns active actors, new CVE counts, active campaigns, top advisories, and risk_trend (increasing/stable/decreasing). One call replaces 5+ chained calls. Ideal for weekly reporting and compliance dashboards."
    },
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "type": "http",
            "method": "GET",
            "queryParams": {
              "period": "30",
              "sector": "energy"
            }
          },
          "output": {
            "type": "json",
            "example": {
              "sector": "energy",
              "new_cves": 12,
              "freshness": "2026-06-13T10:00:00Z",
              "confidence": "high",
              "risk_trend": "increasing",
              "period_days": 30,
              "data_sources": [
                "NVD",
                "CISA-ICS-CERT",
                "MITRE-ATT&CK-ICS",
                "OT-Intel-DB",
                "DeepSeek-CTI-Analysis"
              ],
              "active_actors": [
                "VOLTZITE",
                "SANDWORM",
                "BENTONITE"
              ],
              "critical_cves": 3,
              "top_advisories": [
                {
                  "id": "ICSA-26-150-01",
                  "title": "Siemens SIMATIC S7-1500",
                  "cvss_max": 9.8
                }
              ],
              "active_campaigns": 2,
              "recommended_actions": [
                "Patch CVE-2023-38380 on all internet-facing Siemens devices",
                "Monitor for LOTL techniques on OT-adjacent hosts",
                "Review remote access paths into the energy DMZ"
              ],
              "risk_trend_rationale": "VOLTZITE pre-positioning activity increased in Q2 2026 targeting US electric grid."
            }
          }
        },
        "schema": {
          "type": "object",
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "required": [
            "input"
          ],
          "properties": {
            "input": {
              "type": "object",
              "required": [
                "type",
                "method"
              ],
              "properties": {
                "type": {
                  "type": "string",
                  "const": "http"
                },
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "type": "object",
                  "required": [
                    "sector"
                  ],
                  "properties": {
                    "period": {
                      "type": "string",
                      "description": "Lookback window in days, default 30"
                    },
                    "sector": {
                      "type": "string",
                      "description": "Industrial sector e.g. energy, water, manufacturing, oil-and-gas, electric, nuclear"
                    }
                  }
                }
              },
              "additionalProperties": false
            },
            "output": {
              "type": "object",
              "required": [
                "type"
              ],
              "properties": {
                "type": {
                  "type": "string"
                },
                "example": {
                  "type": "object"
                }
              }
            }
          }
        }
      }
    },
    "x402Version": 2
  },
  {
    "error": "Payment required",
    "accepts": [
      {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
        "amount": "30000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      }
    ],
    "resource": {
      "url": "https://ot-intel-api.onrender.com/ot/delta",
      "mimeType": "application/json",
      "description": "ICS sector change feed — only what is NEW in the last N days. Pass ?sector=water&days=7. Returns new CVEs, new CISA advisories, and new actor activity since the last call. Designed for cron-based monitoring agents. Eliminates redundant reprocessing."
    },
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "type": "http",
            "method": "GET",
            "queryParams": {
              "days": "7",
              "sector": "water"
            }
          },
          "output": {
            "type": "json",
            "example": {
              "since": "2026-06-06T00:00:00Z",
              "sector": "water",
              "new_cves": [
                {
                  "id": "CVE-2026-1234",
                  "cvss": 9.1,
                  "ot_severity": "critical",
                  "affected_vendors": [
                    "Schneider Electric"
                  ]
                }
              ],
              "freshness": "2026-06-13T10:00:00Z",
              "net_change": "1 new critical CVE, 1 new advisory",
              "data_sources": [
                "NVD",
                "CISA-ICS-CERT",
                "MITRE-ATT&CK-ICS"
              ],
              "new_advisories": [
                {
                  "id": "ICSA-26-164-01",
                  "title": "Schneider Electric Modicon",
                  "cvss_max": 9.1
                }
              ],
              "new_actor_activity": []
            }
          }
        },
        "schema": {
          "type": "object",
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "required": [
            "input"
          ],
          "properties": {
            "input": {
              "type": "object",
              "required": [
                "type",
                "method"
              ],
              "properties": {
                "type": {
                  "type": "string",
                  "const": "http"
                },
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "type": "object",
                  "required": [
                    "sector"
                  ],
                  "properties": {
                    "days": {
                      "type": "string",
                      "description": "Lookback window in days, default 7, max 30"
                    },
                    "sector": {
                      "type": "string",
                      "description": "Industrial sector e.g. energy, water, manufacturing, oil-and-gas, electric"
                    }
                  }
                }
              },
              "additionalProperties": false
            },
            "output": {
              "type": "object",
              "required": [
                "type"
              ],
              "properties": {
                "type": {
                  "type": "string"
                },
                "example": {
                  "type": "object"
                }
              }
            }
          }
        }
      }
    },
    "x402Version": 2
  }
]

OVER TIME

All charts use the 90d selector; each series spans only the dates it has data for. Every series is also served as JSON at /api/v1/services/ot-intel-api/price, /scores, /volume and /buyers. On-chain volume and distinct buyers are measured over the service's settlement address and are a conservative undercount (only settlements that reach a measured facilitator are counted). The on-chain series roll up hourly, so the latest day can be up to about an hour behind; distinct buyers are counted per payout address, so a service that settles to more than one address is an upper bound.

UPTIME

90d UPTIME 100%

RESPONSE TIME

AVG RESP 221ms

PRICE (captured 402, USD)

Median across 10 endpoints. Use the selector to isolate one.

SUB-SCORES (uptime + x402 compliance)

checklist grew 11->14 on 2026-07-28; a step here is a metric change, not a regression

PILLARS OVER TIME (measured)

price percentile in Data

site signals present (of 6)

Measured site and economics pillars from the assessment history, so the latest value shown elsewhere on this page reads as a point on a trend rather than a permanent state.

VOLUME (on-chain settlement, USD)

DISTINCT BUYERS

COMPLIANCE

14/14 checks pass · grade A

last 402 captured 2026-07-20 · last up 2026-08-13

402 payload captured
accepts[] array present
payTo address recoverable
payTo at accepts[0].payTo (conformant shape)
payTo is a valid on-chain address
atomic price declared
atomic price in a sane range
asset (token) address declared
network resolves to CAIP-2
payment scheme declared
served over HTTPS
declares the current x402 version (2)
EIP-712 domain parameters present on every EVM entry
x402 v2 envelope delivered in the payment-required header

SITE PILLARS

homepage reachable
openapi doc
pricing page
llms.txt
robots.txt
terms page

recent checks (18) live · click to expand

TIME STATUS RESP CAUSE

15:54:10 UTC ● OK 151ms

15:38:07 UTC ● OK 180ms

15:22:07 UTC ● OK 138ms

15:06:07 UTC ● OK 190ms

14:50:06 UTC ● OK 237ms

14:34:07 UTC ● SLOW 357ms

14:18:07 UTC ● OK 188ms

14:02:06 UTC ● OK 165ms

13:46:06 UTC ● OK 152ms

13:30:06 UTC ● OK 197ms

13:14:04 UTC ● OK 160ms

12:58:04 UTC ● OK 223ms

12:42:05 UTC ● OK 258ms

12:26:03 UTC ● OK 234ms

12:10:04 UTC ● OK 121ms

11:54:05 UTC ● OK 226ms

11:38:07 UTC ● OK 288ms

11:22:06 UTC ● OK 272ms

EMBED THIS BADGE

Show that OT Intel API is monitored on x402-list. Paste this on your site or README, it links back to this live listing.

status

OT Intel API uptime on x402-list — live uptime

// HTML

<a href="https://x402-list.com/services/ot-intel-api?utm_source=badge&utm_medium=referral&utm_campaign=embed">
  <img src="https://x402-list.com/badge/ot-intel-api.svg" alt="OT Intel API listed on x402-list" height="28">
</a>

// Markdown

[![OT Intel API on x402-list](https://x402-list.com/badge/ot-intel-api.svg)](https://x402-list.com/services/ot-intel-api?utm_source=badge&utm_medium=referral&utm_campaign=embed)

// HTML · live uptime variant

<a href="https://x402-list.com/services/ot-intel-api?utm_source=badge&utm_medium=referral&utm_campaign=embed">
  <img src="https://x402-list.com/badge/ot-intel-api.svg?data=uptime" alt="OT Intel API uptime on x402-list" height="28">
</a>

RUN THIS SERVICE?

Keep this listing accurate: propose changes to the name, description, website, category or add new endpoints to monitor. Ownership is verified with a domain proof and every change is reviewed manually; measured data stays read-only.

[ update this listing ]

Earn the verified tier: x402list pays a real call to this endpoint and, if it delivers, the service is delivery-verified. The fee covers the cost of the probe, not the badge; there is no refund if the call does not deliver. Agent and API only, no in-browser signing. See /api.

[ verify this service ($0.25) ]

To request delisting, email info@x402-list.com or update your listing at /services/ot-intel-api/update.