ScanMalware

View saved version →

---
name: pivoting-phishing-infrastructure-with-scanmalware
description: >-
  Expands one phishing URL into its wider campaign using the ScanMalware public scan
  archive (no API key needed): redirect-aware domain history (matched_on), SMQL searches
  on each kit artifact (script SHA-256, favicon MMH3, screenshot hash, page title) plus
  JARM and IP, and CT-derived subdomains, then judges which pivots are selective enough to
  hunt or block on. Use when a reported phishing URL needs its sibling hosts found, when
  checking how an already scanned page was judged, or when a verdict must be attributed to
  the right host after a redirect. Keywords: ScanMalware, SMQL, matched_on, final_url,
  js_sha256, favicon_hash, dhash, jarm, CONFIRMED_SCAM, phishing kit, scanner cloaking.
license: Apache-2.0
---
# Pivoting Phishing Infrastructure with ScanMalware

## Overview

A single phishing URL is rarely the whole campaign. Kits are redeployed across dozens of
disposable hosts, and the pages share artifacts that survive the move: the same bundled
JavaScript, the same favicon, the same rendered screenshot, the same page title. A public
archive of rendered scans lets an analyst search for those artifacts and find the sibling
hosts that were already scanned by someone else.

ScanMalware (scanmalware.com, operated by Triop AB) renders submitted URLs in a sandboxed
browser and keeps the public scans searchable through a REST API and the SMQL query
language. The read endpoints and anonymous scan submission need no account or API key.
This skill covers the pivot procedure and two traps that produce wrong conclusions if
ignored: verdicts attributed to a redirect destination, and pivot values that describe a
hosting platform rather than an actor.

## When to Use

- A user reported a phishing URL and you need the other hosts running the same kit.
- You want to know whether a URL or domain was already scanned, and what it did, before
  submitting it again.
- A domain appears in scan results with a malicious verdict and you must decide whether
  the verdict belongs to that domain or to a page that redirected to it.
- You have a kit artifact (script SHA-256, favicon hash, page title) and want every
  archived page that carries it, newest first.
- You need to decide which indicators from a phishing page are safe to block on without
  blocking a shared hosting platform.

## Prerequisites

- `curl`, `jq` 1.6 or later, and Python 3.8+ (standard library only) for `scripts/agent.py`.
- Outbound HTTPS to `scanmalware.com`. No account or API key is needed for anything in
  this workflow except private scans.
- Rate limits are per source IP: 600 requests per minute anonymously (60 per minute for
  the hash-search pages), 3000 per minute with an API key sent as `X-API-Key`. A 429
  response carries `Retry-After`; wait that many seconds.
- OPSEC: `public` scans (the default) are visible to anyone. If the URL carries a victim's
  email address, token or tracking ID, submit it as `unlisted` (reachable only by scan ID,
  absent from search) or `private` (requires an API key; anonymous requests get HTTP 401).
  Submitting also makes the scanner fetch the URL, which a kit operator can observe.

## Workflow

### Step 1: Check the archive, and read `matched_on`

```bash
DOMAIN=facebook.com
curl -s "https://scanmalware.com/api/v1/domains/$DOMAIN/scans?limit=100" -o history.json
jq -r '.[] | [(.matched_on | join("+")), .scan_id, .url, .final_url] | @tsv' history.json
```

The endpoint lists scans of the domain and its subdomains, matched on the entry host or
the final host after redirects. `matched_on` says which:

| `matched_on` | Meaning | Whose verdict is it |
|---|---|---|
| `["url"]` | Scan was submitted for this domain or one of its subdomains | The host in `url` |
| `["url","final_url"]` | Started and ended under this domain | The host in `url` |
| `["final_url"]` | Started elsewhere and landed here | The entry host in `url`, not this domain |

`"url"` in `matched

Preview of the first 4,000 characters. Read full instructions →

Referenced files: 6 — file references are metadata, not package contents.