URLQuery helps analysts, researchers, and defenders investigate website behavior, infrastructure, and security evidence. A URL is opened in an isolated, instrumented browser environment; network and page activity are recorded and useful artifacts are extracted into a report that can be searched and shared according to its access settings.
How a scan works
- Browser execution
- The browser loads the submitted URL and observes rendering, redirects, JavaScript execution, and activity during the scan.
- Network capture
- Available evidence includes HTTP requests and responses, DNS and IP information, redirect chains, TLS certificates, downloaded resources, and response metadata.
- Page evidence
- Screenshots and page metadata show what the browser encountered. Captured documents, DOM content, and JavaScript help explain the underlying page.
- Artifact processing
- Downloaded and embedded files can be processed for hashes, file types, archive contents, PDF data, Windows shortcut metadata, strings, and detection signals.
Built for investigation
- Phishing triage: inspect landing pages, brand impersonation, redirects, credential collection, and related infrastructure.
- Malware delivery: investigate downloads, scripts, archives, file hashes, and follow-on network activity.
- Infrastructure research: pivot across domains, IPs, certificates, paths, headers, tags, and repeated content.
- Artifact discovery: find extracted files, script hashes, PDF characteristics, shortcut metadata, and other captured indicators.
- Detection validation: compare alerts with the supporting page, network, and file evidence.
- Historical lookup: search earlier reports to understand changes in campaigns, templates, infrastructure, and behavior.
Detection and enrichment
URLQuery combines several complementary approaches. YARA rules recognize patterns in captured content and files; reputation signals provide historical context; network intrusion detection highlights known traffic patterns; and content and behavior analysis help identify suspicious scripts and page activity.
Each approach has limits. New threats, obfuscation, encrypted traffic, and conditional behavior can affect what is captured or detected. Reports show supporting observations so you can assess signals in context. A completed scan or an absence of alerts is not a guarantee that a URL is safe.
Privacy, access, and retention
Public reports are available to all users. Restricted and private reports require the appropriate access; availability depends on account permissions and report ownership or team scope. Public and restricted submissions may be shared with trusted security partners. Private submissions and their analysis data are never shared with these partners.
Analysis data is retained only for as long as necessary for analysis and operational stability, after which it is automatically deleted.
For privacy concerns, removal, redaction, or reclassification, see report review requests. Read our Privacy Policy and Terms of Service for more information.