Pay-per-call OT/ICS threat intelligence API. Endpoints cover CVE triage with OT-adjusted severity, internet-exposed device lookup, threat actor and campaign profiles, IOC enrichment, detection artifacts and compliance framework mapping. Responses are LLM-enriched. Priced in USDC on Base.
Pay from $0.01 to $0.10 per request in USDC on Base, settled onchain via the x402 protocol, no signup, no API key needed.
UPTIME 24H 100% │ 7D 100% │ 30D 100%
ASSESSMENT
updated 5h agoEvidence-backed signals, not a single score. Click any chip for the proof. Measured values stay read-only; unknown is honest.
reliability 100%
- uptime 24h
- 100%
- uptime 7d
- 100%
- uptime 30d
- 100%
- uptime 90d
- 100%
- response p95
- 203ms
- avg response
- 150ms
- total checks
- 47
compliance A (11/11)
11 of 11 x402 conformance checks pass. Full checklist below.
price $0.01 to $0.10 (p62 in Data)
- price (min)
- $0.01
- price (max)
- $0.10
- category percentile (min)
- p62 in Data
- category percentile (max)
- p82 in Data
- endpoints / prices
- 10 / 6
- model
- tiered
- stability
- 100%
risk clean
No deterministic risk flag. Risk fires only on an exact blocklist match, or a reserved-brand name with a mismatched verified payTo. Never from low uptime, a high price, or a model guess.
traction $6.63 30d · 2 buyers
- volume 30d
- $6.63
- buyers 30d
- 2
- settlements 30d
- 49
- last settlement
- 2026-07-21
- top buyer share
- 86% of 30d volume
- trend 7d vs 30d
- 4.29x the 30d daily rate
- networks
- eip155:8453
Conservative undercount: only USDC settlements via facilitators we measure are counted. A measured floor, not an estimate.
Top buyer share is a concentration signal, not part of the ranking score.
WHAT IT DOES
ai-derivedProvides threat intelligence for OT/ICS/SCADA systems including actor profiles, CVE triage, device lookup, IOC enrichment, and campaign tracking.
- category
- threat-intelligence
AI-generated summary. The measured data is never altered by it.
ENDPOINTS
| METHOD | PATH | DESCRIPTION | PRICE | NETWORK | ASSET |
|---|---|---|---|---|---|
| GET | /ot/actor/sector | $0.03 | Base | USDC | |
| GET | /ot/brief | $0.10 | Base | USDC | |
| GET | /ot/campaign | $0.05 | Base | USDC | |
| GET | /ot/compliance | $0.04 | Base | USDC | |
| GET | /ot/cve | $0.02 | Base | USDC | |
| GET | /ot/delta | $0.03 | Base | USDC | |
| GET | /ot/detection | $0.05 | Base | USDC | |
| GET | /ot/device | $0.05 | Base | USDC | |
| GET | /ot/exposure | $0.05 | Base | USDC | |
| GET | /ot/ioc | $0.01 | Base | USDC |
10 endpoints
REQUEST / RESPONSE EXAMPLE
An unpaid request to GET /ot/actor/sector returns HTTP 402 with the payment terms. Settle onchain via your facilitator, then retry with the X-Payment header.
// request
curl -i 'https://ot-intel-api.onrender.com/ot/actor/sector'
// 402 response (captured by monitor) · 10 payloads · click to expand
[
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
"amount": "20000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://ot-intel-api.onrender.com/ot/cve",
"mimeType": "application/json",
"description": "OT-contextualised CVE triage for ICS/SCADA. Pass ?id=CVE-XXXX-XXXX. Returns OT-adjusted severity, cyber-physical impact, patch feasibility, CISA KEV status, and prioritised action. DeepSeek-enriched with live NVD and CISA-KEV data."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"id": "CVE-2023-38802"
}
},
"output": {
"type": "json",
"example": {
"cve_id": "CVE-2019-13945",
"summary": "A vulnerability has been identified in SIMATIC S7-1200 CPU family (All versions). The web server of the affected devices transmits data without TLS encryption.",
"freshness": "2025-05-22T10:00:00.000Z",
"cvss_score": 6.8,
"ot_context": {
"affected_layer": "field_device",
"patch_feasibility": "low — requires maintenance window",
"safety_system_risk": true,
"production_downtime": true,
"ot_adjusted_severity": "high"
},
"data_sources": [
"NVD",
"CISA-KEV",
"DeepSeek-CTI-Analysis"
],
"kev_due_date": null,
"actively_exploited": false,
"recommended_action": "HIGH: Schedule patch for next maintenance window.",
"compensating_controls": [
"Isolate PLC from IT network via VLAN",
"Disable web server interface if unused",
"Deploy unidirectional gateway for historian traffic"
]
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "CVE identifier e.g. CVE-2023-38802"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
"amount": "50000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://ot-intel-api.onrender.com/ot/detection",
"mimeType": "application/json",
"description": "ICS detection artifact retrieval. Pass ?target=PIPEDREAM or ?target=SANDWORM&format=sigma. Returns YARA/Sigma rules for the target malware or actor, sourced from public corpus (Florian Roth signature-base, CISA advisories) with validated:true, or DeepSeek-synthesised with validated:false. Designed for automated threat hunting pipelines that commit rules to SIEMs and EDRs — validated:true rules are safe to deploy; validated:false require lab testing first."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"target": "PIPEDREAM"
}
},
"output": {
"type": "json",
"example": {
"target": "PIPEDREAM",
"freshness": "2026-06-19T10:00:00Z",
"signatures": [
{
"type": "YARA",
"source": "manual",
"raw_rule": "rule PIPEDREAM_INCONTROLLER_Loader { meta: ... strings: ... condition: ... }",
"rule_name": "PIPEDREAM_INCONTROLLER_Loader",
"validated": false,
"ot_safe_note": "Synthesised from CISA advisory AA22-103A. Test against OT baseline before SIEM deployment.",
"target_layer": "engineering_workstation"
}
],
"data_sources": [
"OT-Intel-DB",
"DeepSeek-CTI-Analysis"
],
"artifact_type": "malware",
"validated_count": 0,
"synthesised_count": 1,
"ot_safe_validation": "0 of 1 rules sourced from public corpus. Rules with validated:false require lab testing before production deployment."
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"target"
],
"properties": {
"format": {
"type": "string",
"description": "Rule format: yara | sigma | snort | all (default: all)"
},
"target": {
"type": "string",
"description": "Malware or actor name e.g. PIPEDREAM, INDUSTROYER2, TRITON, SANDWORM, CHERNOVITE"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
"amount": "50000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://ot-intel-api.onrender.com/ot/campaign",
"mimeType": "application/json",
"description": "Active ICS campaign tracker. Pass ?sector=electric&status=active. Returns campaigns currently targeting a sector with actor attribution, start date, targeted geography, TTPs in use, and CVEs being exploited. No free equivalent for live campaign status."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"sector": "electric",
"status": "active"
}
},
"output": {
"type": "json",
"example": {
"sector": "electric",
"status": "active",
"campaigns": [
{
"name": "VOLTZITE Pre-Positioning Campaign",
"actor": "VOLTZITE",
"status": "active",
"confidence": "high",
"start_date": "2023-Q1",
"ttps_in_use": [
"T0859",
"T0812",
"T0885"
],
"exploited_cves": [
"CVE-2023-38380"
],
"targeted_geography": [
"United States",
"Pacific Islands"
]
}
],
"freshness": "2026-06-13T10:00:00Z",
"data_sources": [
"MITRE-ATT&CK-ICS",
"CISA-ICS-CERT",
"OT-Intel-DB",
"DeepSeek-CTI-Analysis"
],
"campaign_count": 2
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"sector"
],
"properties": {
"sector": {
"type": "string",
"description": "Industrial sector e.g. energy, water, electric, manufacturing, oil-and-gas, nuclear, chemical"
},
"status": {
"type": "string",
"description": "active (default) | all"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
"amount": "50000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://ot-intel-api.onrender.com/ot/device",
"mimeType": "application/json",
"description": "ICS/OT device exposure lookup. Pass ?vendor=siemens&model=s7-1200. Returns default credential risk, exposed OT protocols (Modbus/502, S7comm/102, DNP3/20000), exploitation notes, and hardening steps. Covers Siemens, Schneider, Rockwell, Honeywell, GE, Unitronics, Beckhoff."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"model": "vision",
"vendor": "unitronics"
}
},
"output": {
"type": "json",
"example": {
"query": {
"model": "vision",
"vendor": "unitronics"
},
"freshness": "2025-05-22T10:00:00.000Z",
"data_sources": [
"NVD",
"CISA-ICS-CERT",
"DeepSeek-CTI-Analysis"
],
"recommended_action": "Change default credentials immediately. No downtime required.",
"ot_protocols_at_risk": [
"PCOM (20256)",
"Modbus TCP (502)"
],
"default_credential_risk": {
"note": "Default password 1111 on port 20256. Actively exploited by IRGC 2023–2024.",
"risk": "critical"
}
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"vendor",
"model"
],
"properties": {
"model": {
"type": "string",
"description": "Model or product line e.g. s7-1200, quantum, logix, vision"
},
"vendor": {
"type": "string",
"description": "Vendor name e.g. siemens, schneider, rockwell, honeywell, unitronics, ge, beckhoff"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
"amount": "50000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://ot-intel-api.onrender.com/ot/exposure",
"mimeType": "application/json",
"description": "OT asset risk verdict. Pass ?vendor=siemens&model=s7-1500§or=energy&network=internet-facing. Returns risk_score (0-100), risk_level, escalate (boolean), recommended_action, active CVEs, and threat actors. Optional firmware param enables firmware-specific CVE matching. Cached 1 hour."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"model": "s7-1500",
"sector": "energy",
"vendor": "siemens",
"network": "internet-facing"
}
},
"output": {
"type": "json",
"example": {
"model": "s7-1500",
"sector": "energy",
"vendor": "siemens",
"network": "internet-facing",
"escalate": true,
"freshness": "2026-06-13T10:00:00Z",
"confidence": "high",
"risk_level": "critical",
"risk_score": 87,
"top_threat": "VOLTZITE pre-positioning via CVE-2023-38380",
"active_cves": 3,
"ttl_seconds": 3600,
"data_sources": [
"NVD",
"CISA-KEV",
"MITRE-ATT&CK-ICS",
"DeepSeek-CTI-Analysis"
],
"threat_actors": [
"VOLTZITE",
"SANDWORM"
],
"active_campaigns": 2,
"recommended_action": "isolate"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"vendor",
"model",
"sector",
"network"
],
"properties": {
"model": {
"type": "string",
"description": "Device model e.g. s7-1500, modicon-m340, controllogix"
},
"sector": {
"type": "string",
"description": "Industrial sector e.g. energy, water, manufacturing, oil-and-gas"
},
"vendor": {
"type": "string",
"description": "Vendor name e.g. siemens, schneider, rockwell, ge, honeywell"
},
"network": {
"type": "string",
"description": "Network exposure: internet-facing | dmz | lan-only | air-gapped"
},
"firmware": {
"type": "string",
"description": "Firmware version e.g. 2.9.2 (optional — enables firmware-specific CVE matching)"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
"amount": "30000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://ot-intel-api.onrender.com/ot/actor/sector",
"mimeType": "application/json",
"description": "ICS threat actors by sector. Pass ?sector=energy. Returns all groups targeting that sector from live MITRE ATT&CK ICS STIX data. Covers energy, water, manufacturing, oil-and-gas, chemical, transportation, nuclear."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"sector": "energy"
}
},
"output": {
"type": "json",
"example": {
"count": 2,
"query": {
"sector": "energy"
},
"freshness": "2025-05-22T10:00:00.000Z",
"data_sources": [
"MITRE-ATT&CK-ICS",
"DeepSeek-CTI-Analysis"
],
"actors_targeting_sector": [
{
"name": "SANDWORM",
"attribution": "Russia — GRU Unit 74455",
"activity_status": "ACTIVE",
"physical_impact": "CONFIRMED DESTRUCTIVE"
},
{
"name": "VOLTZITE",
"attribution": "China",
"activity_status": "ACTIVE",
"physical_impact": "LIKELY"
}
]
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"sector"
],
"properties": {
"sector": {
"type": "string",
"description": "Industry sector e.g. energy, water, manufacturing, oil-and-gas, chemical, transportation, nuclear"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
"amount": "40000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://ot-intel-api.onrender.com/ot/compliance",
"mimeType": "application/json",
"description": "Compliance gap mapping for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443, NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, UAE NESA IA. Pass ?cve_id=CVE-2023-38802 or ?actor=SANDWORM, optionally &framework=<value> to filter. Returns triggered controls (e.g. CIP-007-6 R2, IEC 62443-3-3 SR 5.1), status (NON_COMPLIANT_IF_UNMITIGATED / REVIEW_REQUIRED), required action, and compensating controls. For automated compliance reporting agents on cron."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"cve_id": "CVE-2023-38802"
}
},
"output": {
"type": "json",
"example": {
"cve_id": "CVE-2023-38802",
"query_id": "CVE-2023-38802",
"freshness": "2026-06-19T10:00:00Z",
"frameworks": {
"nerc_cip": [
{
"title": "Security Patch Management",
"status": "NON_COMPLIANT_IF_UNMITIGATED",
"control": "CIP-007-6 R2",
"action_required": "Evaluate CVE-2023-38802 within 35 days of CISA KEV listing.",
"compensating_control": "Network segmentation restricting BGP traffic to SCADA DMZ pending patch."
}
],
"iec_62443_3_3": [
{
"status": "NON_COMPLIANT_IF_UNMITIGATED",
"component": "3-3 SR 5.1",
"requirement": "Network Segmentation",
"compensating_control": "Enforce zone conduits: restrict BGP/ICS protocol traffic to whitelisted source/destination pairs."
}
]
},
"data_sources": [
"OT-Intel-DB-Compliance",
"DeepSeek-CTI-Analysis"
],
"priority_action": "Apply network segmentation at the ESP boundary immediately; schedule CVE patch for next maintenance window.",
"controls_triggered": 2
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [],
"properties": {
"actor": {
"type": "string",
"description": "Threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME — triggers actor-specific control mappings. At least one of cve_id or actor is required."
},
"cve_id": {
"type": "string",
"description": "CVE identifier e.g. CVE-2023-38802 — triggers CVE-specific control mappings. At least one of cve_id or actor is required."
},
"framework": {
"type": "string",
"description": "Optional filter to one compliance framework. Valid values: nerc_cip, iec_62443_2_1, iec_62443_2_4, iec_62443_3_2, iec_62443_3_3, iec_62443_4_2, nist_800_82, nist_csf, cisa_cpg, nca_otcc, uae_nesa_ia. Omit (or pass 'all') to return matches across every framework."
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
"amount": "10000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://ot-intel-api.onrender.com/ot/ioc",
"mimeType": "application/json",
"description": "IOC enrichment with ICS campaign context. Pass ?value=1.2.3.4&type=ip or type=domain. Queries AlienVault OTX, AbuseIPDB, and DeepSeek CTI for OT campaign association. Returns verdict on whether the IOC is linked to ICS-targeting campaigns."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"type": "ip",
"value": "185.220.101.45"
}
},
"output": {
"type": "json",
"example": {
"ioc": {
"type": "ip",
"value": "185.220.101.45"
},
"isp": "Tor Project",
"tor_node": true,
"freshness": "2025-05-22T10:00:00.000Z",
"reputation": -2,
"pulse_count": 50,
"country_code": "DE",
"data_sources": [
"AlienVault-OTX",
"AbuseIPDB",
"DeepSeek-CTI-Analysis"
],
"ics_association": {
"confidence": "high",
"ics_tags_found": [
"ics",
"scada",
"modbus"
],
"campaign_context": "IP observed in VOLTZITE reconnaissance activity against US electric utilities.",
"known_threat_actor": "VOLTZITE",
"associated_with_ics_campaign": true
},
"total_abuse_reports": 142,
"abuse_confidence_score": 87
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"value",
"type"
],
"properties": {
"type": {
"enum": [
"ip",
"domain"
],
"type": "string",
"description": "IOC type: ip or domain"
},
"value": {
"type": "string",
"description": "The IOC: IP address or domain name"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
"amount": "100000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://ot-intel-api.onrender.com/ot/brief",
"mimeType": "application/json",
"description": "Sector threat brief for ICS/OT. Pass ?sector=energy&period=30. Returns active actors, new CVE counts, active campaigns, top advisories, and risk_trend (increasing/stable/decreasing). One call replaces 5+ chained calls. Ideal for weekly reporting and compliance dashboards."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"period": "30",
"sector": "energy"
}
},
"output": {
"type": "json",
"example": {
"sector": "energy",
"new_cves": 12,
"freshness": "2026-06-13T10:00:00Z",
"confidence": "high",
"risk_trend": "increasing",
"period_days": 30,
"data_sources": [
"NVD",
"CISA-ICS-CERT",
"MITRE-ATT&CK-ICS",
"OT-Intel-DB",
"DeepSeek-CTI-Analysis"
],
"active_actors": [
"VOLTZITE",
"SANDWORM",
"BENTONITE"
],
"critical_cves": 3,
"top_advisories": [
{
"id": "ICSA-26-150-01",
"title": "Siemens SIMATIC S7-1500",
"cvss_max": 9.8
}
],
"active_campaigns": 2,
"recommended_actions": [
"Patch CVE-2023-38380 on all internet-facing Siemens devices",
"Monitor for LOTL techniques on OT-adjacent hosts",
"Review remote access paths into the energy DMZ"
],
"risk_trend_rationale": "VOLTZITE pre-positioning activity increased in Q2 2026 targeting US electric grid."
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"sector"
],
"properties": {
"period": {
"type": "string",
"description": "Lookback window in days, default 30"
},
"sector": {
"type": "string",
"description": "Industrial sector e.g. energy, water, manufacturing, oil-and-gas, electric, nuclear"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
},
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
"amount": "30000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://ot-intel-api.onrender.com/ot/delta",
"mimeType": "application/json",
"description": "ICS sector change feed — only what is NEW in the last N days. Pass ?sector=water&days=7. Returns new CVEs, new CISA advisories, and new actor activity since the last call. Designed for cron-based monitoring agents. Eliminates redundant reprocessing."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"days": "7",
"sector": "water"
}
},
"output": {
"type": "json",
"example": {
"since": "2026-06-06T00:00:00Z",
"sector": "water",
"new_cves": [
{
"id": "CVE-2026-1234",
"cvss": 9.1,
"ot_severity": "critical",
"affected_vendors": [
"Schneider Electric"
]
}
],
"freshness": "2026-06-13T10:00:00Z",
"net_change": "1 new critical CVE, 1 new advisory",
"data_sources": [
"NVD",
"CISA-ICS-CERT",
"MITRE-ATT&CK-ICS"
],
"new_advisories": [
{
"id": "ICSA-26-164-01",
"title": "Schneider Electric Modicon",
"cvss_max": 9.1
}
],
"new_actor_activity": []
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"sector"
],
"properties": {
"days": {
"type": "string",
"description": "Lookback window in days, default 7, max 30"
},
"sector": {
"type": "string",
"description": "Industrial sector e.g. energy, water, manufacturing, oil-and-gas, electric"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
}
] UPTIME
RESPONSE TIME
30d UPTIME 100%
UPTIME 30D 100%
AVG RESP 150ms
TOTAL CHECKS 67
RECENT CHECKS
TIME STATUS RESP
● OK 180ms
● OK 180ms
● OK 165ms
● OK 195ms
● OK 220ms
● OK 161ms
● OK 208ms
● OK 123ms
● OK 135ms
● OK 135ms
● OK 141ms
● OK 113ms
● OK 132ms
● OK 132ms
● OK 122ms
● SLOW 228ms
● OK 83ms
● OK 113ms
OVER TIME
All charts share the 30d window selected here. Every series is also served as JSON at /api/v1/services/ot-intel-api/price, /scores, /volume and /buyers. On-chain volume and distinct buyers are measured over the service's settlement address and are a conservative undercount (only settlements that reach a measured facilitator are counted).
PRICE (captured 402, USD)
Median across 10 endpoints. Use the selector to isolate one.
SUB-SCORES (uptime + x402 compliance)
VOLUME (on-chain settlement, USD)
DISTINCT BUYERS
COMPLIANCE
11/11 checks pass · grade A- 402 payload captured
- accepts[] array present
- payTo address recoverable
- payTo at accepts[0].payTo (conformant shape)
- payTo is a valid on-chain address
- atomic price declared
- atomic price in a sane range
- asset (token) address declared
- network resolves to CAIP-2
- payment scheme declared
- served over HTTPS
EMBED THIS BADGE
// HTML
<a href="https://x402-list.com/services/ot-intel-api?utm_source=badge&utm_medium=referral&utm_campaign=embed"> <img src="https://x402-list.com/badge/ot-intel-api.svg" alt="OT Intel API listed on x402-list" height="28"> </a>
// Markdown
[](https://x402-list.com/services/ot-intel-api?utm_source=badge&utm_medium=referral&utm_campaign=embed)
// HTML · live uptime variant
<a href="https://x402-list.com/services/ot-intel-api?utm_source=badge&utm_medium=referral&utm_campaign=embed"> <img src="https://x402-list.com/badge/ot-intel-api.svg?data=uptime" alt="OT Intel API uptime on x402-list" height="28"> </a>