Analyzing Malicious URL with URLScan
FreeSafely analyze suspicious URLs to mitigate threats.
Free · Opens the source repo
What Analyzing Malicious URL with URLScan does
The Analyzing Malicious URL with URLScan skill enables security professionals to leverage the capabilities of URLScan.io, a free service designed for the safe analysis of suspicious URLs. By utilizing this skill, users can submit URLs to URLScan and receive detailed reports that include screenshots, DOM content, HTTP transactions, and JavaScript behavior, all analyzed in a secure, isolated environment. This functionality is particularly useful for investigating phishing attempts, credential harvesting pages, and other malicious web activities without compromising the security of the analyst's system.
The skill guides users through a structured workflow that begins with submitting a URL to URLScan, either through its web interface or API. Once the analysis is complete, users can review the results, which include visual snapshots of the rendered page, detailed network logs, and insights into the technologies used on the site. This information helps security analysts identify potential threats and understand the tactics employed by malicious actors.
Additionally, the skill provides a framework for extracting indicators of compromise (IOCs) from the scan results, such as contacting domains and IP addresses, which can then be cross-referenced with other threat intelligence sources like VirusTotal and PhishTank. This cross-referencing capability enhances the analyst's ability to build detection rules and threat-hunting queries, making it a valuable tool in the arsenal of any security operations center (SOC).
Overall, this skill is tailored for cybersecurity analysts and professionals who require a reliable method for assessing the safety of URLs and gathering actionable intelligence on potential threats. It streamlines the process of URL analysis and provides essential resources for enhancing security monitoring and incident response capabilities.
When to use it
Use this skill when you need to analyze suspicious URLs for phishing or other malicious activities and when you require structured procedures for such investigations.
When not to use it
This skill may not be suitable for general web browsing or for analyzing URLs that do not pose a security risk.
What you can build with it
Investigating a Phishing Incident
Use this skill to analyze a suspicious URL reported by users to determine if it is part of a phishing attack.
Building Detection Rules
Leverage the insights gained from URL analysis to create detection rules for your security monitoring systems.
Cross-Referencing Threat Intelligence
Extract IOCs from analyzed URLs and cross-reference them with databases like VirusTotal for enhanced threat intelligence.
How to install Analyzing Malicious URL with URLScan
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/analyzing-malicious-url-with-urlscan --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Analyzing Malicious URL with URLScan
Overview
URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolated environment. This skill covers using URLScan's web interface and API to investigate phishing URLs, credential harvesting pages, and malicious redirects without exposing the analyst's system to risk.
When to Use
- When investigating security incidents that require analyzing malicious url with urlscan
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- URLScan.io account (free tier available, API key for automation)
- Python 3.8+ with requests library
- Understanding of HTTP protocols and web technologies
- Familiarity with phishing URL patterns
Key Concepts
URLScan Capabilities
- Safe browsing: Renders URLs in isolated Chromium instance
- Screenshot capture: Visual snapshot of the rendered page
- DOM analysis: Full HTML content after JavaScript execution
- Network log: All HTTP requests made by the page (HAR format)
- Certificate analysis: SSL/TLS certificate details
- Technology detection: Identifies web frameworks and libraries
- IP/ASN mapping: Infrastructure intelligence
- Verdict: Community and automated classification
Phishing URL Red Flags
- Newly registered domains (< 30 days)
- Free hosting services (Wix, GitHub Pages, Firebase)
- URL shorteners hiding final destination
- Excessive subdomain depth (login.microsoft.com.evil.com)
- Brand name in subdomain or path, not domain
- Non-standard ports
- Data URIs or base64-encoded content
- JavaScript-heavy pages with minimal HTML
Workflow
Step 1: Submit URL to URLScan
Web: Navigate to https://urlscan.io and submit the suspicious URL
API: POST https://urlscan.io/api/v1/scan/
Header: API-Key: your-api-key
Body: {"url": "https://suspicious-url.com", "visibility": "private"}
Step 2: Analyze Results
- Review screenshot for brand impersonation
- Check redirects and final destination URL
- Examine DOM for credential input forms
- Review network requests for data exfiltration endpoints
- Check SSL certificate validity and issuer
Step 3: Extract IOCs
- Domains and IPs contacted
- URLs in redirect chain
- SHA-256 hashes of page resources
- JavaScript file hashes
Step 4: Cross-Reference with Threat Intelligence
Use the scripts/process.py to automate URL scanning, extract IOCs, and cross-reference with VirusTotal, PhishTank, and Google Safe Browsing.
Tools & Resources
- URLScan.io: https://urlscan.io/
- URLScan API: https://urlscan.io/docs/api/
- VirusTotal URL Scanner: https://www.virustotal.com/
- PhishTank: https://phishtank.org/
- Google Safe Browsing: https://transparencyreport.google.com/safe-browsing/search
- Any.Run: https://any.run/ (interactive sandbox)
- Hybrid Analysis: https://www.hybrid-analysis.com/
Validation
- Successfully scan a suspicious URL via API
- Extract screenshot and identify brand impersonation
- Document complete redirect chain
- Generate IOC list from scan results
- Cross-reference findings with at least 2 threat intelligence sources
Frequently asked questions about Analyzing Malicious URL with URLScan
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.