# OT/ICS IOC Enrichment with Campaign Context

> OT/ICS IOC Enrichment with Campaign Context is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-15).

Enriches an IP address or domain IOC with OT/ICS-specific threat intelligence, combining AlienVault OTX, AbuseIPDB, and DeepSeek CTI to determine if it is linked to industrial control system targeting campaigns.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/ioc
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-onrender-com-01af0b9c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_uUCvtJ2UweKOvTKdxVaA-

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-onrender-com-01af0b9c
```

Example prompt: Can you check if 185.220.101.45 is linked to any known ICS or OT-targeting campaigns — I need a verdict on whether this IP is a threat to industrial environments, including its abuse confidence score and any ICS threat actor associations.

## When to prefer this

Choose this endpoint when you need OT/ICS-specific threat context for an IP or domain, not just generic threat scoring. It is uniquely valuable when investigating incidents in industrial environments (energy, utilities, manufacturing) where understanding ICS campaign linkage matters more than raw spam/fraud scores. Prefer this over generic IP reputation APIs when you need ICS threat actor attribution, OT-tagged feed correlation, and campaign context in a single call.

## Known failure modes

- Missing required query parameters (value or type not provided) — returns 400 or error message
- Invalid IOC type (not 'ip' or 'domain') — may return error or empty result
- IOC not found in any upstream source — returns low-confidence or empty verdict
- Upstream API (OTX, AbuseIPDB, DeepSeek) unavailability — may return partial or degraded results
- Rate limiting or payment failure — returns 402 Payment Required
- Render cold start latency — first request may time out if service is sleeping

## How this service works

IOC enrichment with ICS campaign context. Pass ?value=1.2.3.4&type=ip or type=domain. Queries AlienVault OTX, AbuseIPDB, and DeepSeek CTI for OT campaign association. Returns verdict on whether the IOC is linked to ICS-targeting campaigns.

## Output

Returns a structured verdict indicating whether the IOC (IP or domain) is linked to OT-targeting campaigns, including: OT campaign association flag, AlienVault OTX reputation data (pulse count, OT-tagged feeds), AbuseIPDB metrics (abuse confidence score, ISP, Tor node status), and DeepSeek-generated CTI analysis identifying known ICS threat actor associations and campaign context.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "type": "ip",
   "value": "8.8.8.8"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "value",
      "type"
     ],
     "properties": {
      "type": {
       "enum": [
        "ip",
        "domain"
       ],
       "type": "string",
       "description": "IOC type: ip or domain"
      },
      "value": {
       "type": "string",
       "description": "The IOC: IP address or domain name"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ioc": {
   "type": "ip",
   "value": "185.220.101.45"
  },
  "isp": "Tor Project",
  "tor_node": true,
  "freshness": "2025-05-22T10:00:00.000Z",
  "reputation": -2,
  "pulse_count": 50,
  "country_code": "DE",
  "data_sources": [
   "AlienVault-OTX",
   "AbuseIPDB",
   "DeepSeek-CTI-Analysis"
  ],
  "ics_association": {
   "confidence": "high",
   "ics_tags_found": [
    "ics",
    "scada",
    "modbus"
   ],
   "campaign_context": "IP observed in VOLTZITE reconnaissance activity against US electric utilities.",
   "known_threat_actor": "VOLTZITE",
   "associated_with_ics_campaign": true
  },
  "total_abuse_reports": 142,
  "abuse_confidence_score": 87
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-onrender-com-01af0b9c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)