Update to ScanMalware

{
  "canonical_app_id": "asdk_app_6ac75bbd39c08191ae95c30ac42638e0",
  "connector_id": "asdk_app_6ac75bbd39c08191ae95c30ac42638e0",
  "created_at": "2026-10-08T12:41:26.011447Z",
  "discoverability": "LISTED",
  "id": "plugin_asdk_app_6ac75bbd39c08191ae95c30ac42638e0",
  "is_template": false,
  "is_template_instance": false,
  "is_v2_template": false,
  "name": "scanmalware",
  "release": {
    "app_ids": [
      "asdk_app_6ac75bbd39c08191ae95c30ac42638e0"
    ],
    "app_manifest": {
      "apps": {
        "scanmalware": {
          "id": "asdk_app_6ac75bbd39c08191ae95c30ac42638e0",
          "required": true
        }
      }
    },
    "app_templates": [],
    "description": "Investigate phishing and malicious URLs with the ScanMalware scan archive: the ScanMalware MCP server plus a skill for pivoting from one phishing URL to the rest of its campaign.",
    "display_name": "ScanMalware",
    "id": "pluginrel_ec7d4adba0b88191aa0cf573633bc3ac",
    "interface": {
      "brand_color": "#1E40AF",
      "capabilities": [
        "Read",
        "Write"
      ],
      "category": "Security",
      "composer_icon_dark_url": null,
      "composer_icon_url": "https://files.openai.com/content?id=file_0000000015c4821292518609e8acf330",
      "default_prompt": "Check this suspicious link in ScanMalware and summarize what the page does.",
      "default_prompts": [
        "Check this suspicious link in ScanMalware and summarize what the page does.",
        "Find other phishing pages that reuse this page's favicon or scripts.",
        "Scan this URL as unlisted in ScanMalware and report the verdict."
      ],
      "developer_name": "Triop AB",
      "logo_url": "https://files.openai.com/content?id=file_000000002a7c8212bcffdd0932a639aa",
      "logo_url_dark": null,
      "long_description": "ScanMalware helps security teams investigate suspicious and phishing URLs. It runs a URL through isolated analysis environments, records what the page loaded and ran, checks it against YARA, antivirus and intrusion-detection rules and threat feeds, has AI models classify suspicious pages by scam type, and keeps public scans in a searchable archive, so one reported phishing page can lead to the rest of its campaign.\n\nWith this plugin you can:\n- Look up what the archive already knows about a domain, URL or IP address: the scanner's verdict and risk factors, network requests, indicators, TLS and JARM details, detected technologies, YARA matches, OCR text and RDAP data.\n- Find related scans by domain, IP, ASN, JARM signature, favicon hash, screenshot hash, fuzzy hash, OCR text, tracking key or JavaScript fingerprint, and count many searches at once to see which indicators are specific to one campaign.\n- Follow a domain's DNS history and reverse DNS, and list the hosts seen for a domain.\n- Look up Certificate Transparency records for a domain or IP.\n- Submit a new URL for scanning, choosing whether the result is public or unlisted, and read the verdict when the scan completes.\n\nThe included skill walks through pivoting from one phishing URL to its sibling hosts, and avoids two common mistakes: giving a domain a verdict that belongs to a page that only redirected to it, or to another tenant on a shared hosting platform; and blocking on shared IP addresses or TLS fingerprints that describe a hosting platform rather than an attacker.\n\nScanMalware is a defensive tool. Pages are opened in ScanMalware's isolated analysis environments, not on your device. No account or API key is needed. 143 of the 145 tools only read data; the two that write submit a URL for scanning and record a safe or malicious vote on a scan. A public scan publishes the URL and its results, so use \"unlisted\" for confidential targets.\n\nScanMalware is operated by Triop AB in Sweden.",
      "plugin_category_id": "security",
      "privacy_policy_url": "https://github.com/scanmalware/mcp-server/blob/main/PRIVACY.md",
      "screenshot_urls": [],
      "short_description": "Phishing URL scans and pivots",
      "terms_of_service_url": "https://scanmalware.com/terms",
      "website_url": "https://scanmalware.com"
    },
    "keywords": [
      "phishing",
      "threat-intelligence",
      "url-scanning",
      "osint",
      "security",
      "mcp"
    ],
    "mcp_servers": [
      {
        "key": "scanmalware",
        "metadata": {
          "headers": {},
          "type": "streamable-http",
          "url": "https://mcp.scanmalware.com/mcp"
        }
      }
    ],
    "onboarding_skill_name": null,
    "requires_local_executor": false,
    "skills": [
      {
        "description": "Expands one phishing or fake-download URL into its wider campaign using the ScanMalware public scan archive (no API key needed): redirect-aware domain history (matched_on), SMQL searches on each kit artifact (script SHA-256 including inline scripts, favicon MMH3, screenshot hash, page title) and on the operator's own account keys (analytics IDs, chat-widget licenses, CAPTCHA site keys), plus JARM, IP and CT-derived subdomains, then judges which pivots are selective enough to hunt or block on. Use when a reported phishing URL needs its sibling hosts found, when checking how an already scanned page was judged, or when a verdict must be attributed to the right host after a redirect. Keywords: ScanMalware, SMQL, matched_on, final_url, js_sha256, tracking_id, favicon_hash, dhash, jarm, CONFIRMED_SCAM, phishing kit, scanner cloaking.",
        "interface": {
          "brand_color": null,
          "default_prompt": null,
          "display_name": "pivoting-phishing-infrastructure-with-scanmalware",
          "icon_large_url": null,
          "icon_small_url": null,
          "iconography": "radar",
          "short_description": "Expands one phishing or fake-download URL into its wider campaign using the ScanMalware public scan archive (no API key needed): redirect-aware domain history (matched_on), SMQL searches on each kit artifact (script SHA-256 including inline scripts, favicon MMH3, screenshot hash, page title) and on the operator's own account keys (analytics IDs, chat-widget licenses, CAPTCHA site keys), plus JARM, IP and CT-derived subdomains, then judges which pivots are selective enough to hunt or block on. Use when a reported phishing URL needs its sibling hosts found, when checking how an already scanned page was judged, or when a verdict must be attributed to the right host after a redirect. Keywords: ScanMalware, SMQL, matched_on, final_url, js_sha256, tracking_id, favicon_hash, dhash, jarm, CONFIRMED_SCAM, phishing kit, scanner cloaking."
        },
        "name": "pivoting-phishing-infrastructure-with-scanmalware",
        "plugin_release_skill_id": "pluginrsk_6af5fed446a48191964d332bf4743d9a"
      }
    ],
    "version": "1.3.1"
  },
  "scope": "GLOBAL",
  "share_url": "https://chatgpt.com/plugins/plugin_asdk_app_6ac75bbd39c08191ae95c30ac42638e0?open_in_app",
  "status": "ENABLED"
}