Three keyless sources for the questions an analyst asks first:
- circl-hashlookup 1.0.0: is this hash known software (NSRL, distro
packages, Windows updates)? `score` 0 for a known file, 100 when CIRCL
flags it KnownMalicious, so an enrichment rule with benign 0 marks it
benign; an unknown hash is an HTTP 404, read as "no record". Single and
bulk lookups; base_url for a self-hosted instance.
- rdap 1.0.0: who registered a domain, IP block or AS, and when — with
age_days for the phishing question. Authoritative server from the IANA
bootstrap, rdap.org as fallback; a host name walks up to its registered
domain; GDPR placeholders are not reported as registrants; a TLD with no
RDAP (.ch) is an error, not a fake "unregistered".
- crtsh 1.0.0: Certificate Transparency — sub-domains with first/last seen,
issuers, recent certificates, and a starts_with mode for look-alikes of a
brand (crt.sh no longer searches with a leading wildcard). Retries the
502/503/504 its shared front throws under load.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmWT9wtWHGtZpMS64Hp4q5
f3nris
d2742ec6fb