Discovers and maps adversary-controlled infrastructure (C2 servers, phishing domains, exploit-kit hosts, bulletproof hosting) by pivoting across passive DNS, certificate transparency logs, Shodan/Censys scans, WHOIS records, and network fingerprints (JARM/JA3S).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill tracking-threat-actor-infrastructurenpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill tracking-threat-actor-infrastructure -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill tracking-threat-actor-infrastructure -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/tracking-threat-actor-infrastructuregh skill install mukul975/Anthropic-Cybersecurity-Skills tracking-threat-actor-infrastructuregit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/tracking-threat-actor-infrastructure ~/.claude/skills/tracking-threat-actor-infrastructure # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/tracking-threat-actor-infrastructure ~/.agents/skills/tracking-threat-actor-infrastructure # Codex, Cursor, Gemini CLI, Copilot, OpenCode