Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Analyzing Malicious URL with URLScan · mukul975 | DecimalAI

Analyzing Malicious URL With Urlscan

NewSkillScoreMaintained

analyzing-malicious-url-with-urlscan

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/analyzing-malicious-url-with-urlscan/SKILL.md

decimalai skills pull analyzing-malicious-url-with-urlscan --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/analyzing-malicious-url-with-urlscan/SKILL.md https://app.decimal.ai/s/analyzing-malicious-url-with-urlscan/SKILL.md

Raw file: /s/analyzing-malicious-url-with-urlscan/SKILL.md ↗ · machine-readable summary at /s/analyzing-malicious-url-with-urlscan.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

No measurable change+9% tokens0% turns13% of whole cases pass with skill (3/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-16	✗→✓	▲ Improved	—	—
case-12	✓→✓	＝ Same ✓	—	—
case-05	✓→✓	＝ Same ✓	—	—
case-06	✗→✗	＝ Same ✗	—	—
case-09	✗→✗	＝ Same ✗	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/analyzing-malicious-url-with-urlscan/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/1/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Analyzing Malicious URL with URLScan

Overview

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolated environment. This skill covers using URLScan's web interface and API to investigate phishing URLs, credential harvesting pages, and malicious redirects without exposing the analyst's system to risk.

When to Use

When investigating security incidents that require analyzing malicious url with urlscan
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

URLScan.io account (free tier available, API key for automation)
Python 3.8+ with requests library
Understanding of HTTP protocols and web technologies
Familiarity with phishing URL patterns

Key Concepts

URLScan Capabilities

Safe browsing: Renders URLs in isolated Chromium instance
Screenshot capture: Visual snapshot of the rendered page
DOM analysis: Full HTML content after JavaScript execution
Network log: All HTTP requests made by the page (HAR format)
Certificate analysis: SSL/TLS certificate details
Technology detection: Identifies web frameworks and libraries
IP/ASN mapping: Infrastructure intelligence
Verdict: Community and automated classification

Phishing URL Red Flags

Newly registered domains (< 30 days)
Free hosting services (Wix, GitHub Pages, Firebase)
URL shorteners hiding final destination
Excessive subdomain depth (login.microsoft.com.evil.com)
Brand name in subdomain or path, not domain
Non-standard ports
Data URIs or base64-encoded content
JavaScript-heavy pages with minimal HTML

Workflow

Step 1: Submit URL to URLScan

Web: Navigate to https://urlscan.io and submit the suspicious URL
API: POST https://urlscan.io/api/v1/scan/
     Header: API-Key: your-api-key
     Body: {"url": "https://suspicious-url.com", "visibility": "private"}

Step 2: Analyze Results

Review screenshot for brand impersonation
Check redirects and final destination URL
Examine DOM for credential input forms
Review network requests for data exfiltration endpoints
Check SSL certificate validity and issuer

Step 3: Extract IOCs

Domains and IPs contacted
URLs in redirect chain
SHA-256 hashes of page resources
JavaScript file hashes

Step 4: Cross-Reference with Threat Intelligence

Use the scripts/process.py to automate URL scanning, extract IOCs, and cross-reference with VirusTotal, PhishTank, and Google Safe Browsing.

Tools & Resources

URLScan.io: https://urlscan.io/
URLScan API: https://urlscan.io/docs/api/
VirusTotal URL Scanner: https://www.virustotal.com/
PhishTank: https://phishtank.org/
Google Safe Browsing: https://transparencyreport.google.com/safe-browsing/search
Any.Run: https://any.run/ (interactive sandbox)
Hybrid Analysis: https://www.hybrid-analysis.com/

Validation

Successfully scan a suspicious URL via API
Extract screenshot and identify brand impersonation
Document complete redirect chain
Generate IOC list from scan results
Cross-reference findings with at least 2 threat intelligence sources

Illustrative Want to see what analyzing-malicious-url-with-urlscan would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/27/2026, 23:48 UTC · 23 cases

Lift

0%

50% vs 50%

Agent turns

0%

1.0 vs 1.0

Tokens

+9%

2,061.17 vs 1,885

fail → pass · 1pass → pass · 2fail → fail · 20

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-06 When extracting full HTTP network transaction logs from a URLScan submission to analyze all requests made during page load, what standard browser export file format is used?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 We saw a suspicious link formatted as `https://login.microsoft.com.verify-account-update.net/login`. How does placing brand names inside subdomains rather than the apex domain impact risk classification?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 What specific network-level indicators should an analyst pull from a completed URLScan result to feed into network perimeter blocklists?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-08 A triage analyst noticed a suspicious link pointing to `auth-login.firebaseapp.com` and thinks it must be legitimate because it is hosted on Google infrastructure. What risk factor does hosting authentication pages on free hosting platforms represent?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 When URLScan's passive analysis is insufficient because a phishing page requires interactive user input like solving a CAPTCHA, what interactive sandbox tool is commonly recommended alongside URLScan?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 Does URLScan run dynamic web content by rendering pages in a lightweight Python headless HTML parser, or does it execute client-side scripts inside a real browser engine?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 What is the recommended sequence of operational phases when performing a full URLScan investigation, from initial submission to final threat intel integration?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-14 A suspicious landing page uses `data:text/html;base64,...` inside an iframe to display its content without fetching remote files. How should URL triage identify this pattern?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 Our threat intelligence team wants to create exact file indicators for malicious payloads and page resources loaded during a URLScan run. What cryptographic hash algorithm should be calculated for extracted page resources and JavaScript files?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We recently received a phishing email containing an obscure redirect link targeting internal employees. I want to evaluate this link using URLScan's service. Can you provide the step-by-step triage procedure to analyze the live page visual, document the full redirection path, isolate network endpoints, and produce an IOC list for our threat hunting team?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 When submitting a suspicious URL to the URLScan API (`https://urlscan.io/api/v1/scan/`), we want to simulate a mobile browser client during scan execution. What JSON payload parameter specifies a custom User-Agent header?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 Our SOC team is configuring automated risk scoring for domain registration age during phishing link analysis. What domain age threshold in days typically flags a domain as high risk for phishing activity?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 I am writing a Python script to submit suspicious URLs to URLScan for automated analysis. I plan to send a GET request to the public query endpoint. What is the standard HTTP method and URL endpoint for submitting new URL scans?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 When connecting to URLScan's REST API, I am passing `Authorization: Bearer <token>` in my HTTP headers, but receiving authentication errors. How should the API authentication credential be passed in HTTP headers?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 What SSL/TLS attributes should an analyst verify when analyzing a URLScan report for a suspect banking login site?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 Which external threat intelligence scanning platforms should be queried to cross-reference malicious verdict results obtained from URLScan?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 After extracting a suspicious JavaScript file from a URLScan report, I noticed it uses AST obfuscation with array rotation. Can you write a Node.js script using Babel AST traversal to automatically deobfuscate and rename these JS variables?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 We need to automate URLScan submissions for confidential internal phishing investigations. By default, scans might be public. What JSON payload parameter should we set in the API request body to prevent public indexing of sensitive company URLs?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 A user clicked a malicious link identified in URLScan and downloaded a payload. What Volatility 3 plugins and CLI commands should I run against the host's LSASS memory dump to detect credential dumping?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 When searching DOM content captured by URLScan for credential harvesting forms, should analysts inspect the raw static initial HTTP response HTML or the post-rendered DOM?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 An analyst finds an HTTP URL pointing to port 8443 on a suspicious domain. Why is non-standard port usage flagged during URL triage?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 During triage of a suspicious page, the analyst finds only 3 lines of HTML in the initial response but thousands of lines of obfuscated JavaScript. Is this structure considered normal or suspicious?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 We found a phishing URL in an email impersonating our domain. How do we configure our Microsoft 365 Exchange Online DMARC policy and SPF record syntax in DNS to reject spoofed emails?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of 0 percentage points is the difference between those two pass rates over the 23 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 50%
Pass rate with the skill: 50%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 1
Skill version measured: v1
Run completed: 7/27/2026, 23:48 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signalsno signals yet

BenchmarkRun a verified benchmark with positive lift

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-1% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

No signals yet — run a benchmark or collect evaluated traces to earn a score.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.