AI assistant
The assistant is a chat session on the lab's own model. It reads the same feeds the map does and can run a set of grounded OSINT lookups, then answer with citations. Your questions stay on the lab's hardware — they are not sent to a third-party model.
How it works
Ask a question in plain language. When a question needs live data, the assistant calls a lookup, waits for the result, and summarizes it with the source attached. When it does not know, it says so rather than inventing an answer. Because the model runs locally, there is no per-token bill and no query leaves the lab.
What it can look up
These are the on-demand lookups available to the assistant. Most run with no key; a few return more with an operator key. Results are cached briefly and identify politely to each upstream service.
| Lookup | Returns | Key? |
|---|---|---|
internetdb | Open ports, hostnames, and CVEs for a single IP | No |
crtsh | Certificate Transparency names for one domain | No |
cisa-kev | Known-exploited vulnerabilities from the CISA catalog | No |
ripestat | ASN, prefix, abuse contact, and geo for an IP or prefix | No |
open-meteo | Current weather at a latitude / longitude | No |
gdacs | Global disaster alerts (quakes, cyclones, floods) | No |
reliefweb | UN OCHA humanitarian reports | Optional |
urlhaus | Recent malicious URLs (abuse.ch) | Optional |
threatfox | Recent indicators of compromise (abuse.ch) | Optional |
malwarebazaar | Recent malware sample metadata (abuse.ch) | Optional |
nvd | A single CVE record from the NIST NVD | Optional |
opensanctions-ofac | Names from the OFAC sanctions list (bulk, cached) | No |
otx | Indicator reputation from AlienVault OTX | Yes |
urlscan | urlscan.io search results | Yes |
opencellid | Cell towers near a point | Yes |
opensanctions | OpenSanctions entity search | Yes |
Guardrails
- One target at a time. IP lookups take a single address, never a network range. Domain lookups take one real domain.
- Passive only. Lookups read public, third-party data. seecop does not port-scan, brute-force, or crawl aggressively.
- Summaries, not dumps. The assistant condenses results and cites them; it will not paste an entire certificate log or sanctions list into chat.
- Cached and polite. Responses are cached for around a minute and every request identifies itself to the upstream service.
Example prompts
What ports and known vulnerabilities does 8.8.8.8 expose?
List the certificate transparency names for example.com.
Which CVEs were added to the exploited-vulnerabilities catalog most recently?
Who operates the ASN behind 1.1.1.1, and is there an abuse contact?
Any active disaster alerts in Southeast Asia right now?
Is "example name" on the OFAC sanctions list?A typed, discoverable version of these lookups — callable from assistants and editors with validated arguments — is on the roadmap.