Tool detail

ioc

Enriches an IP or domain indicator with ICS/OT campaign context from AlienVault OTX, AbuseIPDB and DeepSeek CTI, returning a campaign-linkage verdict.

Categories: Security

Use when

check whether an IP or domain is linked to an ICS/OT-targeting campaign
enrich a threat indicator with OT-sector campaign context for an incident report

Not for

not general-purpose threat intel — ICS/OT campaign linkage only
not CVE or device-exposure data — see this API's other /ot/* endpoints

Inputs

GET query params: value (IP or domain, required); type (enum ip|domain, required)

Admitted input schema

{
  "type": "object",
  "properties": {
    "type": {
      "type": "string",
      "minLength": 0,
      "maxLength": 4096,
      "enum": [
        "ip",
        "domain"
      ],
      "description": "IOC type: ip or domain"
    },
    "value": {
      "type": "string",
      "minLength": 0,
      "maxLength": 4096,
      "description": "The IOC: IP address or domain name"
    }
  },
  "required": [
    "value",
    "type"
  ],
  "additionalProperties": false
}

Endpoint

Method: GET
URL: https://ot-intel-api.onrender.com/ot/ioc

Payment

Protocol: x402
Listed price: 0.01 USDC per call on Base
Payment method: exact
Network: eip155:8453
Asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Listed terms are catalog metadata. The caller supplies inputs and calls the tool outside Onelayer. If payment is required, the caller uses a compatible wallet to pay.

Source

Directory: Coinbase x402 Bazaar
Record: GET https://ot-intel-api.onrender.com/ot/ioc
Retrieved: 2026-09-30T20:37:07.382Z
Catalog file SHA-256: 6837ccddf886f0007cf3727ea9d27faaa5047b51b4f425345c554ce1c271a524
Catalog built: 2026-09-30T22:31:58.034Z