Update to ScanMalware

Changed files

Choose a file to see its text changes. Binary or large files show metadata only.

.claude-plugin/plugin.json →

README.md →

gemini-extension.json →

plugin.json →

skills/pivoting-phishing-infrastructure-with-scanmalware/SKILL.md →

skills/pivoting-phishing-infrastructure-with-scanmalware/assets/template.md →

skills/pivoting-phishing-infrastructure-with-scanmalware/references/api-reference.md →

skills/pivoting-phishing-infrastructure-with-scanmalware/references/standards.md →

skills/pivoting-phishing-infrastructure-with-scanmalware/references/workflows.md →

skills/pivoting-phishing-infrastructure-with-scanmalware/scripts/agent.py →

README.md

− removed · + added

--- before
+++ after
@@ -1,21 +1,26 @@
 # ScanMalware plugin
 
 Investigate phishing and malicious URLs with [ScanMalware](https://scanmalware.com) from
-Claude Code, Codex and Gemini CLI. ScanMalware renders URLs in a sandboxed browser and keeps
-every public scan in a searchable archive. This plugin connects your agent to that archive
-and teaches it how to turn one phishing URL into the rest of its campaign.
+Claude Code, Codex and Gemini CLI. ScanMalware runs URLs through isolated analysis
+environments, records what each page loads and runs, and keeps every public scan in a
+searchable archive. This plugin connects your agent to that archive and teaches it how to
+turn one phishing URL into the rest of its campaign.
 
 No account or API key is needed.
 
 ## What it adds
 
 - **The ScanMalware MCP server** (`https://mcp.scanmalware.com/mcp`, remote, no sign-in):
-  128 tools, 126 of them read-only. Read a scan's verdict, network requests, IOCs, TLS and
-  JARM details, detected technologies, YARA matches, OCR text and RDAP data; find related
-  scans by domain, IP, ASN, JARM, favicon hash, screenshot hash, TLSH/ssdeep/sdhash fuzzy
-  hash, OCR text, tracking key or JavaScript fingerprint; look up Certificate Transparency
-  records; submit a new URL for scanning. The two write tools submit a URL for scanning and
-  vote on a scan as safe or malicious.
+  145 tools, 143 of them read-only. Read a scan's verdict, network requests, IOCs, TLS and
+  JARM details, detected technologies, hunting-rule (YARA) matches, DNS answers, OCR text and
+  RDAP data; run advanced searches (SMQL) with facets and match counts; find related scans by
+  domain, IP, ASN, JARM, favicon hash, screenshot hash, TLSH/ssdeep/sdhash fuzzy hash, OCR
+  text, tracking key or JavaScript fingerprint; follow a name's DNS history and reverse DNS;
+  list a scan's searchable values, compare up to 20 scans side by side and list the hosts
+  seen for a domain; look up Certificate Transparency records; read what deobfuscating a
+  page's scripts revealed and the analysis of files a page delivered; submit a new URL for
+  scanning. The two write tools submit a URL for scanning and vote on a scan as safe or
+  malicious. Overview: <https://mcp.scanmalware.com>.
 - **The skill `pivoting-phishing-infrastructure-with-scanmalware`**: a procedure for
   expanding one phishing URL into its sibling hosts, and for avoiding the two mistakes that
   produce wrong conclusions:
@@ -25,7 +30,11 @@
   - blocking on a pivot that describes a hosting platform rather than an actor (shared
     IPs, ASNs and JARM fingerprints).
 
-  It includes `scripts/agent.py` (Python standard library only) and a report template.
+  Besides kit artifacts (script hashes, inline scripts included, favicon, screenshot,
+  title), it pivots on the operator's own account keys, such as an analytics ID or a
+  live-chat license in the page source, which follow the operator across kit rebuilds and
+  hosting platforms. It counts every pivot in one request to tell a kit from a shared
+  platform, turns the kept pivots into a host list, and includes a report template.
 
 ## Install
 
@@ -62,7 +71,7 @@
   arguments (URLs, domains, IP addresses, hashes, scan IDs) there, and the server forwards
   them to the ScanMalware API at `scanmalware.com`. Requests are logged as described in the
   [MCP server privacy policy](https://github.com/scanmalware/mcp-server/blob/main/PRIVACY.md).
-- **The skill's commands and `scripts/agent.py`** call the ScanMalware REST API at
+- **The skill's commands** call the ScanMalware REST API at
   `https://scanmalware.com/api/v1` directly, anonymously. They send the URLs, domains and
   hashes you investigate, and no credentials.
 - **Submitting a URL** makes ScanMalware's scanner visit it, which the site's operator can
@@ -71,7 +80,8 @@
   scan needs a ScanMalware account. The MCP `submit_scan` tool requires you to choose; the
   REST API uses `public` when the choice is left out. Use `unlisted` for client targets and
   anything carrying a victim's email address or token.
-- The plugin runs no hooks, installs no packages and reads no environment variables.
+- The plugin ships no scripts, runs no hooks, installs no packages and reads no
+  environment variables.
 
 ScanMalware's own terms and privacy policy: <https://scanmalware.com/terms>,
 <https://scanmalware.com/privacy>.