passabsent from every registry#7 by calls of 7 on this host
0.02 USDC
per call, as the listing declares it on eip155:
Compare with anotherEvery figure as JSONCite this page
the price, as of 2026-10-11 21:56 UTC · method
- Validation state
- pass
- Uptime, 7 / 30 / 90 days
- — / 100% / 100%
- Calls, trailing 30 days
- 1
- Unique payers, trailing 30 days
- 1
- Last called
- 2026-09-11 23:53 UTC
- First observed by TOLLderived
- 2026-09-12
- Pricederived
- 0.02 USDC
- Networks
- 1
How big is this endpoint among the ones like it?
No trace is drawn of this endpoint’s own volume. Its counters have changed 1 time across 106 observations, and 3 changes are the fewest this site will draw a trace through, because two points and a guess are not a series. Every observation is in the JSON.
ot-intel-api.onrender.com serves ot malware, a GET endpoint that TOLL places in the "other" category, listed in neither registry at the last pull.
On Base, ot malware asks 0.02 USDC per call.
ot malware takes the query parameter name.
The declared response carries name, aliases, confidence, first_seen, capabilities, data_sources and 2 others.
ot malware answered the sweep of 2026-10-11 with a valid 402, as at every sweep since 2026-09-12.
ot malware is one of 7 listed endpoints on ot-intel-api.onrender.com, tied 7th by calls with 1 other among them.
ot malware takes 1% of the calls counted across ot-intel-api.onrender.com.
In the trailing 30 days: one call, one payer.
ot malware was last called 51 days before the snapshot.
Closest in price to ot malware within the "other" category: base64 encode url at api.strale.io and horror story at horrorstoryapi.vercel.app.
ot malware is priced above 81% of comparable listings in the "other" category.
The wallet paid by ot malware is the payee of 12 endpoints on one host.
ot malware was missing from the Coinbase registry at the pull of 2026-10-12, confirmed at the pull of 2026-10-12; that is registry presence, not liveness.
The price of ot malware is declared by 229 other listings in the "other" category too.
Where the sentences above compare this endpoint with others, the comparison is against the index as it stands now, live; the figures above are final.
the payment options, as of 2026-10-11 21:56 UTC · method
| registry | network | asset | amount | scheme | pay to |
|---|---|---|---|---|---|
| Coinbase | eip155: | USDC | 0.02 USDC | exact | 0x188819…7C767B |
the checks, as of 2026-10-11 06:34 UTC · methodendpoint answered HTTP 402
No named check failed.
Every sweep that observed this endpoint, newest first.
| observed, UTC | state | failed checks | sweep |
|---|---|---|---|
| 2026-10-11 06:34 UTC | pass | 0 | daily-2026-10-11 |
| 2026-10-10 14:42 UTC | pass | 0 | daily-2026-10-10 |
| 2026-10-09 07:11 UTC | pass | 0 | daily-2026-10-09 |
| 2026-10-08 08:40 UTC | pass | 0 | daily-2026-10-08 |
| 2026-10-07 07:56 UTC | pass | 0 | daily-2026-10-07 |
| 2026-10-06 08:46 UTC | pass | 0 | daily-2026-10-06 |
| 2026-10-05 07:57 UTC | pass | 0 | daily-2026-10-05 |
| 2026-10-04 10:30 UTC | pass | 0 | daily-2026-10-04 |
| 2026-10-03 05:26 UTC | pass | 0 | daily-2026-10-03 |
| 2026-10-02 14:40 UTC | pass | 0 | daily-2026-10-02 |
| 2026-10-01 07:36 UTC | pass | 0 | daily-2026-10-01 |
| 2026-09-30 06:54 UTC | pass | 0 | daily-2026-09-30 |
| 2026-09-29 19:13 UTC | pass | 0 | daily-2026-09-29 |
| 2026-09-28 06:00 UTC | pass | 0 | daily-2026-09-28 |
| 2026-09-25 20:44 UTC | pass | 0 | daily-2026-09-25 |
| 2026-09-23 06:21 UTC | pass | 0 | daily-2026-09-23 |
| 2026-09-22 06:32 UTC | pass | 0 | daily-2026-09-22 |
| 2026-09-21 06:54 UTC | pass | 0 | daily-2026-09-21 |
| 2026-09-19 04:56 UTC | pass | 0 | daily-2026-09-19 |
| 2026-09-18 10:58 UTC | pass | 0 | daily-2026-09-18 |
| 2026-09-17 04:51 UTC | pass | 0 | daily-2026-09-17 |
| 2026-09-16 04:53 UTC | pass | 0 | daily-2026-09-16 |
| 2026-09-15 04:48 UTC | pass | 0 | daily-2026-09-15 |
| 2026-09-14 04:44 UTC | pass | 0 | daily-2026-09-14 |
| 2026-09-13 04:41 UTC | pass | 0 | daily-2026-09-13 |
| 2026-09-12 06:58 UTC | pass | 0 | daily-2026-09-12 |
| 2026-09-12 05:25 UTC | pass | 0 | new-2026-09-12T05-25-11-634Z |
Presence in a registry, not liveness of the service (method). Newest first.
- absence from Coinbase confirmed, rule v1
- absent from Coinbase at this pull
- back in Coinbase
- absent from Coinbase at this pull
- listed in Coinbase
From the registry record, not validated by TOLL.the declared schema, as of 2026-09-11 23:53 UTC · method
The input and output block
{
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"name": "PIPEDREAM"
}
},
"output": {
"type": "json",
"example": {
"name": "PIPEDREAM",
"aliases": [
"INCONTROLLER"
],
"confidence": "high",
"first_seen": "2022",
"capabilities": [
"discovery",
"lateral_movement",
"disruption",
"destruction"
],
"data_sources": [
"Dragos-Threat-Intelligence",
"OT-Intel-DB",
"MITRE-ATT&CK-ICS",
"DeepSeek-CTI-Analysis"
],
"affected_vendors": [
"Schneider Electric",
"OMRON"
],
"attributed_actor": "CHERNOVITE",
"mitre_techniques": [
"T0843",
"T0821",
"T0855"
],
"targeted_protocols": [
"Modbus",
"OPC UA",
"CODESYS",
"IEC 61850"
],
"detection_signatures": [
"YARA rule: PIPEDREAM_loader",
"Anomalous CODESYS write commands"
]
}
}
}Cite this page
This endpoint is delisted: the page is frozen at its last observation and its live URL is the stable one. Data reuse is under CC BY 4.0 (terms).
Plain text
TOLL, "ot malware on ot-intel-api.onrender.com". https://tollindex.com/e/ot-intel-api-onrender-com-ot-malware-574aae. Accessed [access date].
BibTeX
@misc{toll-e-ot-intel-api-onrender-com-ot-malware-574aae-2026-11-01,
author = {TOLL},
title = {ot malware on ot-intel-api.onrender.com},
howpublished = {\url{https://tollindex.com/e/ot-intel-api-onrender-com-ot-malware-574aae}},
year = {2026},
month = {11},
note = {Frozen at its last observation, 2026-11-01 21:59 UTC. Accessed [access date].}
}None yet. Anything submitted through the form below is published here with its outcome.