Suspi

suspi is the shorten version of Suspicous and helps to quickly show indicators of compromise with mulpiple providers.

How to Use

• ip adresses > ipscan
• domains > domainscan
• mails > mailscan
• hashs > hashscan

Requirements

Add the following tld sites to the trusted domains in order to open them --> Command Palette --> "Trusted Domains"

[
    "https://www.virustotal.com",
    "https://labs.inquest.net",
    "https://otx.alienvault.com",
    "https://urlscan.io",
    "https://www.abuseipdb.com",
    "https://urlhaus.abuse.ch",
    "https://bazaar.abuse.ch",
    "https://crt.sh",
    "https://emailrep.io,
    "https://www.joesecurity.org",
    "https://app.any.run",
    "https://www.filescan.io"
]

Settings

Providers

You can activate or deactivate Providers.

Before Activating a Provider check if you need an API Key!

Proxy

You can set a proxy for the requests.

Exclusions

Available for:

• IPs
• Domains
• Mails

Known Issues

• mailscan not functional yet
• some providers are not fully implemented
• provider quota no implemented
• sometimes notifications are to quick, please check the bell in the right corner

Disclaimer

This extension is in early stage and only used for quick detection of known indicators of compromise.
It doesn't it does not replace a proper analysis.

TODO

• adding more provider
  • mailhunter
  • greynoise
  • waybackmachine
  • emailrep
  • filescan
  • anyrun
• add sidebar history and logs
• may change to class system

Release Notes

0.2.4

• added repository support for extension
• small improvments

0.2.3

• integrated Proxy request in settings
  • if you have issues with NTLM Authentication, consider to use proxyproxy-cli a lightweight listener written in Go - Thanks @MarmorY
• added icon
• small bugfixes

0.2.0(1)

• added background worker with Promise
• indicators are now gruped!
• added more provider (not tested)
• changed structure
• added config in settings incl.
  • added exlusions for ip, domain and mail
  • added API keys to specific providers if needed
  • added request timeout value

0.1.5

initial release of suspi

Support

Enjoy! if you like leave a star or write a message to suspi[at]th1s1s[.]de