f3nris
d2742ec6fb
Three keyless sources for the questions an analyst asks first: - circl-hashlookup 1.0.0: is this hash known software (NSRL, distro packages, Windows updates)? `score` 0 for a known file, 100 when CIRCL flags it KnownMalicious, so an enrichment rule with benign 0 marks it benign; an unknown hash is an HTTP 404, read as "no record". Single and bulk lookups; base_url for a self-hosted instance. - rdap 1.0.0: who registered a domain, IP block or AS, and when — with age_days for the phishing question. Authoritative server from the IANA bootstrap, rdap.org as fallback; a host name walks up to its registered domain; GDPR placeholders are not reported as registrants; a TLD with no RDAP (.ch) is an error, not a fake "unregistered". - crtsh 1.0.0: Certificate Transparency — sub-domains with first/last seen, issuers, recent certificates, and a starts_with mode for look-alikes of a brand (crt.sh no longer searches with a leading wildcard). Retries the 502/503/504 its shared front throws under load. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmWT9wtWHGtZpMS64Hp4q5
66 lines
3.1 KiB
YAML
66 lines
3.1 KiB
YAML
id: rdap
|
|
name: RDAP (WHOIS)
|
|
version: 1.0.0
|
|
description: "RDAP, the IETF successor to WHOIS — who registered a domain, an IP block or an AS number, and when. Answers the first phishing question (how old is this domain?) with `age_days`, plus registrar, status, name servers and the abuse contact. Queries the authoritative registry found through the IANA bootstrap files; free, no API key; stdlib-only. Personal data is usually redacted by registries (GDPR) — expect the registrant to be empty for most domains."
|
|
changelog: "1.0.0 — Initial release: domain, IP and ASN lookups through the IANA bootstrap, test connection."
|
|
category: enrichment
|
|
|
|
config_schema:
|
|
properties:
|
|
bootstrap_url:
|
|
type: string
|
|
description: "Where the IANA bootstrap files live (default https://data.iana.org/rdap)"
|
|
default: https://data.iana.org/rdap
|
|
fallback_url:
|
|
type: string
|
|
description: "RDAP server asked when the bootstrap has no entry for a TLD (default https://rdap.org, a public redirector). Leave empty to fail instead."
|
|
default: https://rdap.org
|
|
insecure:
|
|
type: boolean
|
|
description: "Trust any TLS certificate (not secure)"
|
|
default: false
|
|
required: []
|
|
|
|
commands:
|
|
- id: domain_lookup
|
|
name: rdap-domain-lookup
|
|
description: "Registration data for a domain. A host name (www.mail.example.com) is walked up to the registered domain. Returns a summary — registrar, created, updated, expires, age_days, status, nameservers, abuse_email, registrant (when not redacted), dnssec — and the registry's `rdap` record. An unregistered domain returns HTTP 404."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
domain: { type: string, description: "Domain or host name" }
|
|
include_raw: { type: boolean, description: "Include the registry's full RDAP record under `rdap` (default true)" }
|
|
required: [domain]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ip_lookup
|
|
name: rdap-ip-lookup
|
|
description: "The network an IPv4 / IPv6 address belongs to, from its regional registry (RIPE, ARIN, APNIC, LACNIC, AFRINIC): network name, CIDR, country, holder organisation, abuse contact, allocation date."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ip: { type: string, description: "IPv4 or IPv6 address" }
|
|
include_raw: { type: boolean, description: "Include the registry's full RDAP record under `rdap` (default true)" }
|
|
required: [ip]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: asn_lookup
|
|
name: rdap-asn-lookup
|
|
description: "The holder of an autonomous system number: name, organisation, country, abuse contact, registration date."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
asn: { type: string, description: "AS number (13335 or AS13335)" }
|
|
include_raw: { type: boolean, description: "Include the registry's full RDAP record under `rdap` (default true)" }
|
|
required: [asn]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: rdap-test-connection
|
|
description: "Fetch the IANA domain bootstrap file (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|