Back to Details

analyzing-malicious-url-with-urlscan

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Analyzing Malicious URL with URLScan

使用URLScan分析恶意URL

Overview

概述

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolated environment. This skill covers using URLScan's web interface and API to investigate phishing URLs, credential harvesting pages, and malicious redirects without exposing the analyst's system to risk.
URLScan.io 是一项用于扫描和分析可疑URL的免费服务。它在隔离环境中捕获网页的截图、DOM内容、HTTP事务、JavaScript行为以及网络连接。本技能涵盖如何使用URLScan的网页界面和API来调查钓鱼URL、凭证收集页面以及恶意重定向，同时避免分析人员的系统面临风险。

When to Use

使用场景

  • When investigating security incidents that require analyzing malicious url with urlscan
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques
  • 当调查需要借助URLScan分析恶意URL的安全事件时
  • 当为该领域构建检测规则或威胁狩猎查询时
  • 当SOC分析师需要此类分析的结构化流程时
  • 当验证相关攻击技术的安全监控覆盖范围时

Prerequisites

前提条件

  • URLScan.io account (free tier available, API key for automation)
  • Python 3.8+ with requests library
  • Understanding of HTTP protocols and web technologies
  • Familiarity with phishing URL patterns
  • URLScan.io 账户（提供免费层级，自动化需API密钥）
  • 安装requests库的Python 3.8+版本
  • 了解HTTP协议和Web技术
  • 熟悉钓鱼URL模式

Key Concepts

核心概念

URLScan Capabilities

URLScan功能

  1. Safe browsing: Renders URLs in isolated Chromium instance
  2. Screenshot capture: Visual snapshot of the rendered page
  3. DOM analysis: Full HTML content after JavaScript execution
  4. Network log: All HTTP requests made by the page (HAR format)
  5. Certificate analysis: SSL/TLS certificate details
  6. Technology detection: Identifies web frameworks and libraries
  7. IP/ASN mapping: Infrastructure intelligence
  8. Verdict: Community and automated classification
  1. 安全浏览：在隔离的Chromium实例中渲染URL
  2. 截图捕获：渲染页面的视觉快照
  3. DOM分析：JavaScript执行后的完整HTML内容
  4. 网络日志：页面发起的所有HTTP请求（HAR格式）
  5. 证书分析：SSL/TLS证书详情
  6. 技术检测：识别Web框架和库
  7. IP/ASN映射：基础设施情报
  8. 判定结果：社区和自动分类

Phishing URL Red Flags

钓鱼URL警示信号

  • Newly registered domains (< 30 days)
  • Free hosting services (Wix, GitHub Pages, Firebase)
  • URL shorteners hiding final destination
  • Excessive subdomain depth (login.microsoft.com.evil.com)
  • Brand name in subdomain or path, not domain
  • Non-standard ports
  • Data URIs or base64-encoded content
  • JavaScript-heavy pages with minimal HTML
  • 新注册域名（注册时长<30天）
  • 免费托管服务（Wix、GitHub Pages、Firebase）
  • 隐藏最终目标的URL短链接服务
  • 过深的子域名层级（如login.microsoft.com.evil.com）
  • 品牌名称出现在子域名或路径中，而非主域名
  • 非标准端口
  • Data URI或base64编码内容
  • 以JavaScript为主、HTML内容极少的页面

Workflow

工作流程

Step 1: Submit URL to URLScan

步骤1：向URLScan提交URL

Web: Navigate to https://urlscan.io and submit the suspicious URL
API: POST https://urlscan.io/api/v1/scan/
     Header: API-Key: your-api-key
     Body: {"url": "https://suspicious-url.com", "visibility": "private"}
Web: 访问https://urlscan.io并提交可疑URL
API: POST https://urlscan.io/api/v1/scan/
     Header: API-Key: your-api-key
     Body: {"url": "https://suspicious-url.com", "visibility": "private"}

Step 2: Analyze Results

步骤2：分析结果

  • Review screenshot for brand impersonation
  • Check redirects and final destination URL
  • Examine DOM for credential input forms
  • Review network requests for data exfiltration endpoints
  • Check SSL certificate validity and issuer
  • 查看截图，识别品牌仿冒情况
  • 检查重定向和最终目标URL
  • 检查DOM中的凭证输入表单
  • 查看网络请求，寻找数据泄露端点
  • 检查SSL证书的有效性和颁发者

Step 3: Extract IOCs

步骤3：提取IOC

  • Domains and IPs contacted
  • URLs in redirect chain
  • SHA-256 hashes of page resources
  • JavaScript file hashes
  • 关联的域名和IP
  • 重定向链中的URL
  • 页面资源的SHA-256哈希值
  • JavaScript文件哈希值

Step 4: Cross-Reference with Threat Intelligence

步骤4：与威胁情报交叉验证

Use the 
scripts/process.py
to automate URL scanning, extract IOCs, and cross-reference with VirusTotal, PhishTank, and Google Safe Browsing.
使用
scripts/process.py
自动化URL扫描、提取IOC，并与VirusTotal、PhishTank和Google安全浏览进行交叉验证。

Tools & Resources

工具与资源

Validation

验证标准

  • Successfully scan a suspicious URL via API
  • Extract screenshot and identify brand impersonation
  • Document complete redirect chain
  • Generate IOC list from scan results
  • Cross-reference findings with at least 2 threat intelligence sources
  • 通过API成功扫描一个可疑URL
  • 提取截图并识别品牌仿冒情况
  • 记录完整的重定向链
  • 从扫描结果生成IOC列表
  • 与至少2个威胁情报源交叉验证发现结果