| description | Threat intelligence enrichment for IPs, domains, file hashes โ combines AbuseIPDB, Maltiverse (classification + tags), DNS, WHOIS, ipapi.co (HTTPS geolocation + proxy/VPN/TOR detection), Shodan (ports, CVEs, OS), and VirusTotal (community votes, tags, network) into a unified 0-100 reputation score. Trigger when user asks IOC, reputation, ืืื ืืืื, ืืื IP ืืืื ื, blacklist, threat intel, lookup, whois, dns, domain age, virustotal, abuseipdb, maltiverse, shodan, ip reputation, network osint. |
| metadata | {"clawdbot":{"emoji":"๐ฐ๏ธ","commands":["ip","domain","hash","dns","whois","sweep","cluster","israeli","cert","attack","feeds"],"commands_schema":{"ip":{"properties":{"target":{"type":"string","description":"IP address to lookup (IPv4 or IPv6)"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["target"]},"domain":{"properties":{"target":{"type":"string","description":"Domain name (FQDN) to lookup"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["target"]},"hash":{"properties":{"target":{"type":"string","description":"File hash to check (md5, sha1, or sha256)"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["target"]},"dns":{"properties":{"target":{"type":"string","description":"Domain name for DNS lookup (A/AAAA/MX/TXT/NS)"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["target"]},"whois":{"properties":{"target":{"type":"string","description":"Domain or IP for WHOIS/RDAP lookup"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["target"]},"sweep":{"properties":{"threshold":{"type":"integer","default":10,"description":"Minimum threat score to flag connections (0-100)"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":[]},"cluster":{"properties":{"targets":{"type":"string","description":"Comma-separated IOCs (IPs, domains, hashes) to cluster"},"threshold":{"type":"number","default":0.8,"description":"Cosine similarity threshold for clustering (0.0-1.0)"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["targets"]},"israeli":{"properties":{"target":{"type":"string","description":"IP address or domain for Israeli-specific monitoring"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["target"]},"cert":{"properties":{"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":[]},"attack":{"properties":{"technique":{"type":"string","description":"MITRE ATT&CK technique ID (e.g. T1059, T1071, T1090)"},"format":{"type":"string","enum":["markdown","json"],"default":"json"}},"required":["technique"]},"feeds":{"properties":{"source":{"type":"string","enum":["urlhaus","threatfox","all"],"description":"Threat feed source (URLhaus malicious URLs, ThreatFox botnet C2 IOCs)"},"limit":{"type":"integer","default":50,"description":"Max IOCs to display"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["source"]}},"arg_template":"scripts/intel.py {command} {args}","requires":{"bins":["python"]},"install":[]}} |
