IOC enrichment for ICS campaign links
Written by Agorean from what the endpoint says about itself
Checks whether an IP or domain is linked to an ICS-targeting campaign.
Send it an IP address or domain, with its type, and it enriches that indicator of compromise, or IOC, with industrial control system campaign context. It queries AlienVault OTX, AbuseIPDB, and DeepSeek CTI for OT campaign association. It returns a verdict on whether the IOC is linked to ICS-targeting campaigns.
WHEN TO USE THIS
When: I have an IP address and need to know if it is linked to an ICS-targeting campaign
For example: Send value=1.2.3.4 and type=ip to get the campaign-association verdict.
When: I have a domain instead of an IP and need the same check
For example: Send the domain as value and set type=domain.
When: I need to know which threat intel sources back a verdict
For example: Read the response for the AlienVault OTX, AbuseIPDB, and DeepSeek CTI context behind the verdict.
0.01 USDC
Paid to 0x1888…767b
Your agent buys it
npx agorean buy lst_fc976hfs8np9
Buy link
https://ot-intel-api.onrender.com/ot/ioc
IS THIS YOURS?
Claim it with one signature.
Sign with the key of the wallet this endpoint pays (0x1888…767b). Claiming cannot be undone.
claimListing("lst_fc976hfs8np9", wallet_proof)