{"id":7569,"external_id":"plugin_asdk_app_6ac75bbd39c08191ae95c30ac42638e0","name":"scanmalware","display_name":"ScanMalware","developer":"Triop AB","category":"Security","listing_language":"en","listing_language_details":{"method":"cld-0.13.0/listing-v1","reliable":true,"detected_at":"2026-10-24T12:46:09Z","input_sha256":"6ffbf503c8e1d0d8be9b3d9ee554cac244ce4534598317d343040e848654f1b3","source_fields":["release.description","release.interface.short_description","release.interface.long_description"]},"version":"1.0.0","skill_count":1,"first_seen_at":"2026-10-24T12:40:23.232Z","last_seen_at":"2026-11-04T06:00:02.689Z","last_changed_at":"2026-10-27T01:01:04.022Z","install_count":null,"search_matches":[],"research_summary":null,"research_reviewed_at":null,"metadata":{"canonical_app_id":"asdk_app_6ac75bbd39c08191ae95c30ac42638e0","connector_id":"asdk_app_6ac75bbd39c08191ae95c30ac42638e0","created_at":"2026-10-08T12:41:26.011447Z","discoverability":"LISTED","id":"plugin_asdk_app_6ac75bbd39c08191ae95c30ac42638e0","is_template":false,"is_template_instance":false,"name":"scanmalware","release":{"app_ids":["asdk_app_6ac75bbd39c08191ae95c30ac42638e0"],"app_manifest":{"apps":{"scanmalware":{"id":"asdk_app_6ac75bbd39c08191ae95c30ac42638e0","required":true}}},"app_templates":[],"description":"Investigate phishing and malicious URLs with the ScanMalware scan archive: the ScanMalware MCP server plus a skill for pivoting from one phishing URL to the rest of its campaign.","display_name":"ScanMalware","id":"pluginrel_784627aca32c819186a52f4db38e19b2","interface":{"brand_color":"#1E40AF","capabilities":["Read","Write"],"category":"Security","composer_icon_dark_url":null,"composer_icon_url":"https://files.openai.com/content?id=file_000000001b0881f4958443af2151ba73","default_prompt":"Check this suspicious link in ScanMalware and summarize what the page does.","default_prompts":["Check this suspicious link in ScanMalware and summarize what the page does.","Find other phishing pages that reuse this page's favicon or scripts.","Scan this URL as unlisted in ScanMalware and report the verdict."],"developer_name":"Triop AB","logo_url":"https://files.openai.com/content?id=file_00000000644481f4b2186655857650b5","logo_url_dark":null,"long_description":"ScanMalware helps security teams investigate suspicious and phishing URLs. It renders a URL in a sandboxed browser, records what the page loaded and did, and keeps public scans in a searchable archive, so one reported phishing page can lead to the rest of its campaign.\n\nWith this plugin you can:\n- Look up what the archive already knows about a domain, URL or IP address: the scanner's verdict and risk factors, network requests, indicators, TLS and JARM details, detected technologies, YARA matches, OCR text and RDAP data.\n- Find related scans by domain, IP, ASN, JARM signature, favicon hash, screenshot hash, fuzzy hash, OCR text, tracking key or JavaScript fingerprint.\n- Look up Certificate Transparency records for a domain or IP.\n- Submit a new URL for scanning, choosing whether the result is public or unlisted, and read the verdict when the scan completes.\n\nThe included skill walks through pivoting from one phishing URL to its sibling hosts, and avoids two common mistakes: giving a domain a verdict that belongs to a page that only redirected to it, or to another tenant on a shared hosting platform; and blocking on shared IP addresses or TLS fingerprints that describe a hosting platform rather than an attacker.\n\nScanMalware is a defensive tool. Pages are opened in ScanMalware's isolated browser, not on your device. No account or API key is needed. 126 of the 128 tools only read data; the two that write submit a URL for scanning and record a safe or malicious vote on a scan. A public scan publishes the URL and its results, so use \"unlisted\" for confidential targets.\n\nScanMalware is operated by Triop AB in Sweden.","plugin_category_id":"security","privacy_policy_url":"https://github.com/scanmalware/mcp-server/blob/main/PRIVACY.md","screenshot_urls":[],"short_description":"Phishing URL scans and pivots","terms_of_service_url":"https://scanmalware.com/terms","website_url":"https://scanmalware.com"},"keywords":["phishing","threat-intelligence","url-scanning","osint","security","mcp"],"onboarding_skill_name":null,"requires_local_executor":false,"skills":[{"description":"Expands one phishing URL into its wider campaign using the ScanMalware public scan archive (no API key needed): redirect-aware domain history (matched_on), SMQL searches on each kit artifact (script SHA-256, favicon MMH3, screenshot hash, page title) plus JARM and IP, and CT-derived subdomains, then judges which pivots are selective enough to hunt or block on. Use when a reported phishing URL needs its sibling hosts found, when checking how an already scanned page was judged, or when a verdict must be attributed to the right host after a redirect. Keywords: ScanMalware, SMQL, matched_on, final_url, js_sha256, favicon_hash, dhash, jarm, CONFIRMED_SCAM, phishing kit, scanner cloaking.","interface":{"brand_color":null,"default_prompt":null,"display_name":"pivoting-phishing-infrastructure-with-scanmalware","icon_large_url":null,"icon_small_url":null,"iconography":"radar","short_description":"Expands one phishing URL into its wider campaign using the ScanMalware public scan archive (no API key needed): redirect-aware domain history (matched_on), SMQL searches on each kit artifact (script SHA-256, favicon MMH3, screenshot hash, page title) plus JARM and IP, and CT-derived subdomains, then judges which pivots are selective enough to hunt or block on. Use when a reported phishing URL needs its sibling hosts found, when checking how an already scanned page was judged, or when a verdict must be attributed to the right host after a redirect. Keywords: ScanMalware, SMQL, matched_on, final_url, js_sha256, favicon_hash, dhash, jarm, CONFIRMED_SCAM, phishing kit, scanner cloaking."},"name":"pivoting-phishing-infrastructure-with-scanmalware","plugin_release_skill_id":"pluginrsk_6ac75bc022e0819181abe148a9b6311b"}],"version":"1.0.0"},"scope":"GLOBAL","status":"ENABLED"},"research":null,"package_metadata":{"name":"scanmalware","author":{"url":"https://scanmalware.com","name":"Triop AB"},"license":"Apache-2.0","sources":[{"path":"plugin.json","sha256":"4d9c4bd196e514f03d4616aa90474a825d51ddb492d829ceaf1f16b1d8422c92"},{"path":".claude-plugin/plugin.json","sha256":"83e4c5e72eabe6592d744a7ae26f524c40a73652fb7a108f7fc638e75d896652"}],"version":"1.0.0","homepage":"https://github.com/scanmalware/scanmalware-plugin","keywords":["phishing","threat-intelligence","url-scanning","osint","security","mcp"],"repository":"https://github.com/scanmalware/scanmalware-plugin","artifact_id":140011,"observed_at":"2026-11-03T19:19:10Z","support_url":"https://scanmalware.com/contact","capabilities":["Read","Write"],"field_sources":{"name":0,"author":0,"license":0,"version":0,"homepage":0,"keywords":0,"repository":0,"support_url":0,"capabilities":0},"extraction_version":1,"conflicts_or_errors":[]}}