Analyzing Malicious URL with URLScan

SkillSecurity

Lets your agent scan and analyze suspicious URLs to check if they are safe.

Available today. Use it from your connected AI after setup.

No other account needed.

Connect ahel once, and every AI you use reads what you have installed.

Then ask your AI: use the Analyzing Malicious URL with URLScan skill

About this capability

URLScan.io is a free service for scanning and analyzing suspicious URLs.

What this skill tells your AI

The instructions your AI receives, as published by mukul975/anthropic-cybersecurity-skills in skills/analyzing-malicious-url-with-urlscan/SKILL.md and read by ahel’s review.

Overview

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolated environment. This skill covers using URLScan's web interface and API to investigate phishing URLs, credential harvesting pages, and malicious redirects without exposing the analyst's system to risk.

When to Use

When investigating security incidents that require analyzing malicious url with urlscan
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

URLScan.io account (free tier available, API key for automation)
Python 3.8+ with requests library
Understanding of HTTP protocols and web technologies
Familiarity with phishing URL patterns

Key Concepts

URLScan Capabilities

Safe browsing: Renders URLs in isolated Chromium instance
Screenshot capture: Visual snapshot of the rendered page
DOM analysis: Full HTML content after JavaScript execution
Network log: All HTTP requests made by the page (HAR format)
Certificate analysis: SSL/TLS certificate details
Technology detection: Identifies web frameworks and libraries
IP/ASN mapping: Infrastructure intelligence
Verdict: Community and automated classification

Phishing URL Red Flags

Newly registered domains (< 30 days)
Free hosting services (Wix, GitHub Pages, Firebase)
URL shorteners hiding final destination
Excessive subdomain depth (login.microsoft.com.evil.com)
Brand name in subdomain or path, not domain
Non-standard ports
Data URIs or base64-encoded content
JavaScript-heavy pages with minimal HTML

Workflow

Step 1: Submit URL to URLScan

Web: Navigate to https://urlscan.io and submit the suspicious URL
API: POST https://urlscan.io/api/v1/scan/
     Header: API-Key: your-api-key
     Body: {"url": "https://suspicious-url.com", "visibility": "private"}