AbuseIPDB API reference. IP reputation and abuse report lookups.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
免费在 GitHub 公开
greynoise-api
GreyNoise API reference. Internet scanner/noise classification for IPs.
中文简介正在准备中。当前显示原文说明。
查看安装方法包含的文件（1）
- SKILL.md2.1 KB
SKILL.md（原文）
安装前可以查看交给 AI 代理的指令内容。
GreyNoise API
Base URL
- Community:
https://api.greynoise.io/v3/community - Enterprise:
https://api.greynoise.io/v3
Authentication
Header: key: $GREYNOISE_API_KEY
Rate Limits
- Community (free): 50 requests/day
- Enterprise: Based on plan
Key Endpoints
Community IP Lookup (Free)
curl -s "https://api.greynoise.io/v3/community/{ip}" \
-H "key: $GREYNOISE_API_KEY"
Response fields:
noise— true if IP is a known internet scannerriot— true if IP belongs to a known benign service (CDN, DNS, etc.)classification— benign|malicious|unknownname— actor name if identifiedlast_seen— last observation datemessage— human-readable summary
Enterprise Context (Paid)
curl -s "https://api.greynoise.io/v3/noise/context/{ip}" \
-H "key: $GREYNOISE_API_KEY"
Additional fields: tags, cve, os, ports, raw_data
Classification Meaning
| Classification | Meaning | Action |
|---|---|---|
benign + noise:true | Known benign scanner (Shodan, Censys, etc.) | Likely false positive — deprioritise |
malicious + noise:true | Known malicious scanner | Real threat, but opportunistic, not targeted |
unknown + noise:true | Unclassified scanner | Investigate further |
noise:false + riot:false | Not a known scanner | May be targeted — investigate |
riot:true | Known benign service | Definitely deprioritise |
CTI Value
GreyNoise answers: "Is this IP scanning the whole internet, or is it specifically targeting us?"
- If
noise:true→ opportunistic, not targeted - If
noise:false→ potentially targeted, higher priority
Response Summary Format
ip: <IP>
noise: <true/false>
riot: <true/false>
classification: benign|malicious|unknown
name: <actor name or "unknown">
last_seen: <date>
message: <summary>
verdict: benign-scanner|malicious-scanner|not-scanner|benign-service
评价
还没有评价。欢迎分享你的使用感受。
评论
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
同一仓库的技能
ach
免费Analysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Runs on ungraded evidence when asked, labelled as such, unweighted, and capped at Moderate confidence.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
Censys API v2 reference. Host reconnaissance and certificate data.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新