mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
88 lines
1.6 KiB
Markdown
88 lines
1.6 KiB
Markdown
# URL Analysis Report Template
|
|
|
|
## Analysis Information
|
|
- **Analyst**: [Name]
|
|
- **Date**: [YYYY-MM-DD]
|
|
- **Case ID**: [CASE-XXXX]
|
|
- **Source**: [User report / Email gateway / SIEM alert]
|
|
|
|
## URL Details
|
|
| Field | Value |
|
|
|---|---|
|
|
| Original URL | |
|
|
| Defanged URL | hxxps://... |
|
|
| Final URL (after redirects) | |
|
|
| URLScan UUID | |
|
|
| Scan visibility | private/public |
|
|
|
|
## Page Analysis
|
|
| Field | Value |
|
|
|---|---|
|
|
| Page Title | |
|
|
| HTTP Status | |
|
|
| Server | |
|
|
| Domain | |
|
|
| IP Address | |
|
|
| ASN | |
|
|
| Country | |
|
|
| Login Form Detected | Yes/No |
|
|
|
|
## TLS Certificate
|
|
| Field | Value |
|
|
|---|---|
|
|
| Issuer | |
|
|
| Subject | |
|
|
| Valid From | |
|
|
| Valid To | |
|
|
| Certificate Age | |
|
|
|
|
## Redirect Chain
|
|
| # | URL | Status |
|
|
|---|---|---|
|
|
| 1 (original) | | |
|
|
| 2 | | |
|
|
| 3 (final) | | |
|
|
|
|
## Threat Intelligence Cross-Reference
|
|
| Source | Result | Score |
|
|
|---|---|---|
|
|
| URLScan Verdict | | |
|
|
| VirusTotal | /XX engines | |
|
|
| PhishTank | | |
|
|
| Google Safe Browsing | | |
|
|
| AbuseIPDB | | |
|
|
|
|
## IOCs Extracted
|
|
### Domains
|
|
| Domain | Role | Reputation |
|
|
|---|---|---|
|
|
| | | |
|
|
|
|
### IP Addresses
|
|
| IP | ASN | Country | Reputation |
|
|
|---|---|---|---|
|
|
| | | | |
|
|
|
|
### File Hashes
|
|
| Hash (SHA-256) | Type | Size |
|
|
|---|---|---|
|
|
| | | |
|
|
|
|
## Classification
|
|
- [ ] Phishing - Credential Harvesting
|
|
- [ ] Phishing - Malware Delivery
|
|
- [ ] Scam / Fraud
|
|
- [ ] Benign
|
|
- [ ] Inconclusive
|
|
|
|
## Recommended Actions
|
|
- [ ] Block domain at proxy/firewall
|
|
- [ ] Block IP at firewall
|
|
- [ ] Add to email gateway blocklist
|
|
- [ ] Submit to PhishTank / APWG
|
|
- [ ] Notify affected users
|
|
- [ ] Request domain takedown
|
|
|
|
## Notes
|
|
[Additional analysis observations]
|