arabic-threat-intel

name	arabic-threat-intel
slug	arabic-threat-intel
display_name	Arabic Threat Intelligence — استخبارات المصادر المفتوحة
version	1.0.0
author	neo-kw
license	MIT
tags	["osint","threat-intelligence","arabic","cybersecurity","telegram","dark-web","apt","middle-east","incident-response"]
validation	{"tested_on":"OpenClaw 2026.3.13","requires_tools":["exec","read","write"],"no_api_key_required":true,"optional":["tor (for dark web search)"]}
changelog	[{"version":"1.0.0","date":"2026-03-18","changes":["Initial release","Arabic Telegram channel OSINT monitoring","Bilingual Arabic/English threat report generation","Dark web search via Tor","CT log passive subdomain discovery","Iran-linked APT group tracking"]}]
description	The only Arabic-first OSINT and threat intelligence skill. Monitor Arabic-language threat actor channels on Telegram, generate bilingual threat reports, search the dark web via Tor, and enumerate subdomains via Certificate Transparency logs. Works for any region — Middle East, Africa, Asia, or global. No API keys required.
argument-hint	<channel|report|darkweb|scan> [target] [--lang ar|en|both] [--region all|me|africa|asia]

Arabic Threat Intelligence

The only Arabic-first OSINT and threat intelligence skill for OpenClaw. Works globally — not limited to any single country or region.

Why This Skill

99% of OSINT skills are English-only. Arabic-speaking analysts, security teams, and researchers lack native-language tooling. This skill bridges that gap with full bilingual (Arabic + English) support.

Commands

Monitor Telegram Channels

Use arabic-threat-intel channel hak994
Use arabic-threat-intel channel anyChannelName --lang both

Scrapes public Telegram channels. Returns posts with timestamps, auto-translates Hebrew/Farsi mentions.

Generate Threat Report

Use arabic-threat-intel report "critical infrastructure"
Use arabic-threat-intel report "ransomware" --lang both

Monitors tracked threat actor channels and generates a structured bilingual threat brief ready for leadership or SOC teams.

Dark Web Search

Use arabic-threat-intel darkweb "company name data leak"
Use arabic-threat-intel darkweb "اسم الشركة تسريب"

Searches dark web indexes via Tor. Accepts Arabic or English queries. Returns .onion links with risk assessment.

CT Log Subdomain Scan

Use arabic-threat-intel scan example.com
Use arabic-threat-intel scan target-domain.org

Passive subdomain discovery via Certificate Transparency logs (crt.sh). Flags takeover candidates, dev/test servers, VPN and admin panels.

Tracked Threat Groups

Group	Platform	Origin	Targeting
Fatimion Cyber Team	Telegram @hak994	Iran	Infrastructure, Oil & Gas
313 Team	Telegram @xX313XxTeam	Iran	Government sites
Fattah Cyber	Telegram @fattah_irili	Iran	Tech, Media
Handala Hack	Web	Iran (MOIS)	Financial, Defense
Various APT34/MuddyWater	Multiple	Iran	Telecom, Energy

Output Options

Flag	Description
--lang ar	Arabic only (RTL output)