ScanMalware

ScanMalware helps security teams investigate suspicious and phishing URLs. It renders a URL in a sandboxed browser, records what the page loaded and did, and keeps public scans in a searchable archive, so one reported phishing page can lead to the rest of its campaign. With this plugin you can: - Look up what the archive already knows about a domain, URL or IP address: the scanner's verdict and risk factors, network requests, indicators, TLS and JARM details, detected technologies, YARA matches, OCR text and RDAP data. - Find related scans by domain, IP, ASN, JARM signature, favicon hash, screenshot hash, fuzzy hash, OCR text, tracking key or JavaScript fingerprint. - Look up Certificate Transparency records for a domain or IP. - Submit a new URL for scanning, choosing whether the result is public or unlisted, and read the verdict when the scan completes. The included skill walks through pivoting from one phishing URL to its sibling hosts, and avoids two common mistakes: giving a domain a verdict that belongs to a page that only redirected to it, or to another tenant on a shared hosting platform; and blocking on shared IP addresses or TLS fingerprints that describe a hosting platform rather than an attacker. ScanMalware is a defensive tool. Pages are opened in ScanMalware's isolated browser, not on your device. No account or API key is needed. 126 of the 128 tools only read data; the two that write submit a URL for scanning and record a safe or malicious vote on a scan. A public scan publishes the URL and its results, so use "unlisted" for confidential targets. ScanMalware is operated by Triop AB in Sweden.