Arabic Threat Intelligence#

The only Arabic-first OSINT and threat intelligence skill for OpenClaw. Works globally — not limited to any single country or region.

Why This Skill#

99% of OSINT skills are English-only. Arabic-speaking analysts, security teams, and researchers lack native-language tooling. This skill bridges that gap with full bilingual (Arabic + English) support.

Commands#

Monitor Telegram Channels#

text

Use arabic-threat-intel channel hak994
Use arabic-threat-intel channel anyChannelName --lang both

Scrapes public Telegram channels. Returns posts with timestamps, auto-translates Hebrew/Farsi mentions.

Generate Threat Report#

text

Use arabic-threat-intel report "critical infrastructure"
Use arabic-threat-intel report "ransomware" --lang both

Monitors tracked threat actor channels and generates a structured bilingual threat brief ready for leadership or SOC teams.

Dark Web Search#

text

Use arabic-threat-intel darkweb "company name data leak"
Use arabic-threat-intel darkweb "اسم الشركة تسريب"

Searches dark web indexes via Tor. Accepts Arabic or English queries. Returns .onion links with risk assessment.

CT Log Subdomain Scan#

text

Use arabic-threat-intel scan example.com
Use arabic-threat-intel scan target-domain.org

Passive subdomain discovery via Certificate Transparency logs (crt.sh). Flags takeover candidates, dev/test servers, VPN and admin panels.

Tracked Threat Groups#

GroupPlatformOriginTargetingFatimion Cyber TeamTelegram @hak994IranInfrastructure, Oil & Gas313 TeamTelegram @xX313XxTeamIranGovernment sitesFattah CyberTelegram @fattah_iriliIranTech, MediaHandala HackWebIran (MOIS)Financial, DefenseVarious APT34/MuddyWaterMultipleIranTelecom, Energy

Output Options#

FlagDescription--lang arArabic only (RTL output)--lang enEnglish only--lang bothBilingual report (default)--region meMiddle East focus--region africaAfrica focus--region allGlobal (default)

Requirements#

• No API keys required for CT log scanning and Telegram monitoring
• Optional: Tor for dark web search ( service tor start)
• Python 3.10+ (pre-installed with OpenClaw)

Use Cases#

• 🔒 SOC teams monitoring Arabic-language threat actors
• 🕵️ OSINT investigators tracking dark web activity
• 📰 Journalists covering cybersecurity in the Middle East
• 🎓 Security researchers and students learning Arabic OSINT
• 🏢 Enterprise security teams with MENA exposure
• 🌍 Any analyst tracking Iran-linked APT groups globally

Security & Ethics#

This skill performs passive OSINT only. All sources are publicly accessible:

• Telegram public channels (t.me/s/)
• Certificate Transparency logs (crt.sh)
• Dark web search engines via Tor (Ahmia, OnionLand)

No active exploitation. No unauthorized scanning.