Threat Intelligence
Security analysis, URL reputation scanning, breach indexing, and forensic metadata tools.
/breach
Check whether a public breach index has entries for an email address.
| Attribute | Details |
|---|---|
| Access Tier | Whitelisted User |
| Provider | External Breach Intelligence Database |
| Data Stored | Ephemeral (Query processed in-memory, zero database logging) |
Options
| Option | Description | Type | Required |
|---|---|---|---|
email | Email address to check. | String | Yes |
ephemeral | Hide this response. | Boolean | No |
Examples
text
/breach email:"user@example.com"/exif
Extract metadata embedded in an image.
| Attribute | Details |
|---|---|
| Access Tier | Whitelisted User |
| Provider | Local Exif-Parser (Buffer cap 10MB) |
| Data Stored | Ephemeral (Extracted metadata displayed, never stored) |
Options
| Option | Description | Type | Required |
|---|---|---|---|
image | Image to inspect. | Attachment | Yes |
ephemeral | Hide this response. | Boolean | No |
Examples
text
/exif image:<attachment>/phishcheck
Show available VirusTotal analysis signals for a URL.
| Attribute | Details |
|---|---|
| Access Tier | Whitelisted User |
| Provider | VirusTotal API |
| Data Stored | Ephemeral (Target URL/hash sent to VirusTotal) |
Options
| Option | Description | Type | Required |
|---|---|---|---|
url | Public HTTP or HTTPS URL. | String | Yes |
ephemeral | Hide this response. | Boolean | No |
Examples
text
/phishcheck target:"https://suspicious-site.com"/portscan
Scan common ports on an authorized public host.
| Attribute | Details |
|---|---|
| Access Tier | Operator / Bot Administrator Only |
| Provider | Direct Socket Connection via net.Socket (1500ms timeout) |
| Data Stored | Ephemeral |
Options
| Option | Description | Type | Required |
|---|---|---|---|
target | Public hostname you own or may test. | String | Yes |
authorized | Confirm that you are authorized to scan this host. | Boolean | Yes |
ephemeral | Hide this response. | Boolean | No |
Examples
text
/portscan target:"example.com" authorized:true/urlscan
Submit a public URL to urlscan.io as unlisted.
| Attribute | Details |
|---|---|
| Access Tier | Whitelisted User |
| Provider | urlscan.io API |
| Data Stored | Ephemeral (Target URL submitted for analysis) |
Options
| Option | Description | Type | Required |
|---|---|---|---|
url | Public URL. Query parameters and fragments are removed. | String | Yes |
consent | Confirm submission to the third-party urlscan.io service. | Boolean | Yes |
ephemeral | Hide this response. | Boolean | No |
Examples
text
/urlscan target:"https://example.com"