crt.sh often answers 502 for minutes at a time. When it is down,
sub-domain and exact searches are now answered by SSLMate Cert Spotter,
which reads the same CT logs; its rows are reshaped into crt.sh's so the
output keeps its shape, plus 'source' and 'complete'. starts_with has no
fallback (Cert Spotter cannot search by prefix).
Riposte kills an integration script at 60 s, and the old retry loop
(4 x 120 s) could never finish. Every call now takes its timeout from a
55 s budget, with 15 s kept for the fallback; only 5xx are retried.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmWT9wtWHGtZpMS64Hp4q5
Three keyless sources for the questions an analyst asks first:
- circl-hashlookup 1.0.0: is this hash known software (NSRL, distro
packages, Windows updates)? `score` 0 for a known file, 100 when CIRCL
flags it KnownMalicious, so an enrichment rule with benign 0 marks it
benign; an unknown hash is an HTTP 404, read as "no record". Single and
bulk lookups; base_url for a self-hosted instance.
- rdap 1.0.0: who registered a domain, IP block or AS, and when — with
age_days for the phishing question. Authoritative server from the IANA
bootstrap, rdap.org as fallback; a host name walks up to its registered
domain; GDPR placeholders are not reported as registrants; a TLD with no
RDAP (.ch) is an error, not a fake "unregistered".
- crtsh 1.0.0: Certificate Transparency — sub-domains with first/last seen,
issuers, recent certificates, and a starts_with mode for look-alikes of a
brand (crt.sh no longer searches with a leading wildcard). Retries the
502/503/504 its shared front throws under load.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmWT9wtWHGtZpMS64Hp4q5
f3nris