[ADD] macadress.com Lookup module

[samymassoud]

Description

Adds a new hover expansion module, macadress.com Lookup, which enriches a mac-address attribute by querying the macadress.com API (https://macadress.com/).

For a given MAC address, the module returns:

• Vendor identity: organization, OUI, matched registry prefix, and vendor country
• Registration status and block type
• Address administration type (universally vs. locally administered) and transmission type (unicast/multicast)
• Device category inference and confidence
• Virtualization/container-network platform detection
• Special-use address classification (broadcast, multicast, VRRP, HSRP, STP, LACP, 802.1X, LLDP)
• Randomization confidence, to flag potentially randomized/spoofed addresses
• A plain-English explanation of the result

Requirements

An API key for macadress.com (api_key module config). The service offers 1,000 free lookups/month, with paid plans for higher volume, as well as a self-hosted option.

Files changed

• misp_modules/modules/expansion/macadress_com.py: the module itself
• documentation/logos/macadress_com.png: module logo

References

• https://macadress.com/
• https://macadress.com/docs

Checklist

• Module follows the existing hover-module conventions (mispattributes, moduleinfo, moduleconfig, handler, introspection, version)
• Handles missing/invalid API key (401), rate limiting (429), and invalid MAC address (400) responses
• Network errors are caught and surfaced via misperrors

[adulau]

Thank you for the contribution.