GENE-WebAmon
One gene. One tool with six focused operations. Two analyst-grade prompts. Free tier included. Pro tier unlocks the full database.
GENE-WebAmon - Web Threat Intelligence and Domain Scanning for AI Workflows
Every domain on the internet leaves a trace. Webamon collects and indexes those traces - screenshots, infrastructure fingerprints, scan results, phishing signals - and makes them queryable in real time. GENE-WebAmon puts that intelligence directly inside your AI assistant.
One gene. One tool with six focused operations. Two analyst-grade prompts. Free tier included. Pro tier unlocks the full database.
The Tool: Webamon Threat Intelligence
The core tool covers the full Webamon API in a single interface. Each option is built for a specific investigative need. Pick the one that matches your situation and get structured results back immediately.
Your AI assistant can ask the tool to describe itself at any time - what options it accepts, what each parameter does, and what the response looks like. No documentation tab required.
| Option | What It Does | Tier |
|---|---|---|
| search | Full-text search across the Webamon database. Find domains, IPs, URLs, and infrastructure by keyword or indicator. | Free / Pro |
| lucene | Precision field-level queries using Lucene syntax. Target specific fields like domain names, IP ranges, technologies, or certificates across four indexed datasets. | Free / Pro |
| scan | Submit any domain or URL for a live Webamon scan. Returns the scan report ID for follow-up retrieval. | Free |
| screenshot | Retrieve a visual screenshot of a scanned domain. The image is saved directly to your gene dataspace as a PNG file - ready to reference or attach. | Free |
| takedown-check | Look up the full takedown history and audit trail for a domain. See who reported it, when, and what the outcome was. | Pro |
| takedown-submit | Submit a formal takedown request for a malicious domain. Specify the reason, description, tag, and reporter contact. | Pro |
Free Tier and Pro Tier
GENE-WebAmon works out of the box without any API key. The free tier covers search, lucene (limited), scan, and screenshot - up to 20 calls per day. That is enough for interactive use and focused investigations.
Set a Webamon API key and the gene upgrades automatically. Search and lucene shift to the Pro endpoint with a 1,000+ call daily limit. Takedown operations - check and submit - require Pro access and will prompt you if no key is configured.
The API is provided by:
https://webamon.com
Two Prompts Built for CTI Analysts
The tool returns raw intelligence. The prompts turn it into analysis. Both activate a specialized AI persona - a Senior CTI Specialist with deep knowledge of the Webamon platform - that interprets the data and tells you what it means.
Webamon Threat Hunt
Give it any indicator: a domain, IP address, URL fragment, or file hash. The prompt runs the search, reads the results, and produces a five-part threat intelligence report - executive summary, key indicators of compromise, threat classification, risk rating, and concrete analyst recommendations. If results are thin, it tells you why and suggests the right follow-up action.
Built for speed. Built for operators who need answers, not a research task that takes an hour.
Webamon Domain Scan and Report
Submits a domain for a live scan, waits for the result, and builds a structured web infrastructure security assessment. Optionally cross-references the infostealer database to check whether the domain has been observed in credential-harvesting malware. The output covers technologies detected, hosting infrastructure, certificate data, observed behaviors, and a prioritized risk summary.
Useful for pre-engagement reconnaissance, third-party vendor assessments, and active incident enrichment.
Screenshots Stored in Your Dataspace
When you retrieve a screenshot, GENE-WebAmon does not just return a base64 string. It decodes the image and saves it as a real PNG file in your gene dataspace. The file path comes back in the response - reference it, attach it, or use it in a downstream flow step.
No manual conversion. No clipboard gymnastics. The image is just there.
Built for Feluda Flows
Every tool option and both prompts are composable in Feluda Flows. Chain them together with other genes to build automated threat intelligence pipelines that run without manual intervention.
Some practical flow patterns:
- New phishing alert arrives? Automatically search Webamon for the reported domain, grab a screenshot, and attach both to the incident.
- Suspicious domain flagged by your detection stack? Run a live scan, retrieve the full report, and route the risk rating to the right SOC queue.
- Third-party vendor review? Trigger a domain scan and infostealer cross-check on every new supplier domain as part of your onboarding flow.
- Active takedown campaign? Submit takedown requests in bulk through a flow, then periodically check status with takedown-check until resolved.
- Daily threat briefing? Schedule a threat hunt on your primary domains every morning, formatted and ready to deliver.
The intelligence does not wait for an analyst to start a session. The flow runs, the data comes back, and the right people get notified - automatically.
Who Gets the Most Out of This Gene
| Role | Primary Use | Best Starting Point |
|---|---|---|
| SOC Analyst | Enrich phishing and malicious domain alerts with live scan data and screenshots | Webamon Threat Hunt prompt |
| Threat Intelligence Analyst | Hunt infrastructure, pivot on indicators, classify threat campaigns | lucene option with field-level precision queries |
| Incident Responder | Rapidly profile suspicious domains encountered during an active incident | Webamon Domain Scan and Report prompt |
| Penetration Tester | Map target web infrastructure and identify exposed services before an engagement | scan + screenshot for visual recon |
| Abuse and Trust and Safety | Identify, document, and submit takedown requests for malicious domains | takedown-check then takedown-submit |
| Security Engineer | Automate domain monitoring and threat enrichment in detection pipelines | Feluda Flow combining search and scan |
What You Get
- 1 tool - Webamon Threat Intelligence with 6 operations: search, lucene, scan, screenshot, takedown-check, takedown-submit
- 2 analyst prompts - Webamon Threat Hunt, Webamon Domain Scan and Report
- Free tier included - no API key needed to get started
- Pro tier support - set a Webamon API key to unlock full database access and takedown operations
- Screenshot storage - domain screenshots saved as PNG files directly in your gene dataspace
- Flow-ready - all tools and prompts work inside Feluda Flows
- Version: 1.0.0
- Author: Reza Rafati
You might also like
Activate GENE-WEBAMON
Current credits: 0