LinkedIn post for CTI/ICS security audience. Pass ?actor=VOLTZITE or ?cve=CVE-XXXX-XXXX. Fans out to actor or cve + advisory. Returns hook line, 3-5 intelligence bullets, call to action, hashtags. Ready to publish. Ideal for security practitioners and threat intelligence teams sharing findings.

ICS detection artifact retrieval. Pass ?target=PIPEDREAM or ?target=SANDWORM&format=sigma. Returns YARA/Sigma rules for the target malware or actor, sourced from public corpus (Florian Roth signature-base, CISA advisories) with validated:true, or DeepSeek-synthesised with validated:false. Designed for automated threat hunting pipelines that commit rules to SIEMs and EDRs — validated:true rules are safe to deploy; validated:false require lab testing first.

X/Twitter thread (5-7 posts) for an ICS actor or CVE. Pass ?actor=XENOTIME or ?cve=CVE-XXXX-XXXX. Fans out to actor or cve. Returns thread array: hook post, intel posts with ATT&CK IDs and affected OT systems, mitigation post, hashtag post. Each post under 280 characters.

Search USPTO patents by keyword, inventor, assignee, CPC class, or filing date range. Returns abstracts, inventors, assignees, and publication numbers from the USPTO Open Data backend — a patent lookup and prior-art search endpoint for agents.

Sector situation report. Pass ?sector=energy&period=30. Fans out to actor/sector, advisory, campaign, delta, compliance primitives. Returns 30-day threat landscape, top actors, new advisories, what changed, compliance posture, recommended priorities. Designed for weekly security briefing automation.

ICS sector change feed — only what is NEW in the last N days. Pass ?sector=water&days=7. Returns new CVEs, new CISA advisories, and new actor activity since the last call. Designed for cron-based monitoring agents. Eliminates redundant reprocessing.

Pay-per-call IP lookup and risk intelligence API. Send an IPv4 or IPv6 address and receive JSON with risk score, risk label, ASN, ISP, organization, geolocation, reverse DNS, hosting/proxy/VPN/Tor signals, verified bot detection, scanner/honeypot indicators, and AI-powered subnet behavior analysis via x402 v2 on Base.

Sector threat brief for ICS/OT. Pass ?sector=energy&period=30. Returns active actors, new CVE counts, active campaigns, top advisories, and risk_trend (increasing/stable/decreasing). One call replaces 5+ chained calls. Ideal for weekly reporting and compliance dashboards.

Ranked Google search results with title, URL, snippet, and domain from Decodo Google Search. A SERP API intended for routers that need source discovery without LLM synthesis.

Deep actor intelligence dossier. Pass ?actor=SANDWORM. Fans out to actor, campaign, malware, ioc, asn, detection primitives and synthesises via DeepSeek. Returns full profile, infrastructure, IOC table, detection rules, kill chain mapping. Most comprehensive single-call artifact available.

ICS threat actor ASN infrastructure profiling. Pass ?asn=AS215540. Returns ICS actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, NakedPages), bulletproof hosting indicators, abuse categories (c2, staging, phishing), and an OT-specific blocking recommendation with WAF rule hint. ASN analysis reveals infrastructure clustering that survives IP/domain rotation — critical for OT defenders tracking persistent actor infrastructure.

OT asset risk verdict. Pass ?vendor=siemens&model=s7-1500&sector=energy&network=internet-facing. Returns risk_score (0-100), risk_level, escalate (boolean), recommended_action, active CVEs, and threat actors. Optional firmware param enables firmware-specific CVE matching. Cached 1 hour.

ICS malware encyclopedia. Pass ?name=PIPEDREAM. Returns capabilities, targeted OT protocols, attributed actor, affected vendors, detection signatures, and MITRE ATT&CK ICS techniques. Covers PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY.

Synthesised Markdown threat actor report for ICS/OT. Pass ?actor=CHERNOVITE&sector=energy. Fans out to actor, campaign, malware, advisory, detection primitives internally (no extra charge) and synthesises via DeepSeek. Returns executive summary, TTPs, campaigns, malware, recommended actions. TLP: WHITE.

Get Amazon product reviews by ASIN or URL: review text, star rating, title, author, date, verified-purchase and Vine flags, helpful votes and variant, plus the product star-rating breakdown. Async: a first call with asin returns a snapshot id (collection ~40s); call again with that snapshot to fetch reviews. For review mining, sentiment, complaint detection and competitor weakness analysis. 亚马逊评论挖掘与差评分析。

Generate a professional quote as a hosted PDF in ~1s. Returns quote number, totals, hosted quote page, PDF URL, QR code, Stripe payment link for the end customer, and expiration date. Works for any vertical (home services, photographers, agencies, consultants).

CVE and exploitation-in-the-wild signals from Telegram CTI channels. Filters: severity, min_confidence, since, tag(cve|exploit|poc|patch), ttp, type(cve), limit, offset. Returns CVE IDs, affected products, exploit status.

Ransomware group activity from Telegram: victim posts, leak site announcements, extortion demands. Filters: severity, min_confidence, since, tag(lockbit|blackcat|cl0p|ransomhub), sector, country, limit, offset.

Raw source verification for a TeleSint record. Pass id (UUID from any items[].id). Returns original defanged message text and source language alongside the AI summary for provenance checks.

Cross-category pivot across all TeleSint intel. Use ?q= for broad keyword or combine filters: category, severity, sector, country, tag, ttp, name, organization, min_confidence, since. Returns items[] across any category.