Data Points

🔗 URL

Uniform Resource Locator pointing to a web resource.
Network

Sources

6
6 no-auth

Disciplines

5
that use it

Mission domains

4
reach

Workbench

open →
native tool

🔧 Native workbench

Open URL workbench →Advanced search →Link analysis →

🔎 Live indicators (IoC view)

URL indicators →IoC dashboard →Search url →

🔗 Analyst pivots

Search platform →OSINT pivot →Source catalog →

🔌 Sources that yield URL (6)

SourceCategoryAuthFormat
EU DisinfoLab / DFRLab
Influence-operation research & case studies.		DISINFOINTNONEhtmlhome↗ api↗
GNET (Global Network on Extremism & Tech)
Online extremism research hub.		ExtremismNONEhtmlhome↗
INHOPE Hotline Network
Global network of CSAM reporting hotlines.		Child ProtectionNONEhtmlhome↗
Internet Watch Foundation
CSAM URL/hash reporting authority.		Child ProtectionNONEhtmlhome↗
NCMEC CyberTipline
US clearinghouse for child exploitation reports.		Child ProtectionNONEhtmlhome↗
Tech Against Terrorism / TCAP
Terrorist content analytics platform.		ExtremismNONEhtmlhome↗

🧭 Disciplines

DISINFOINT (3) →HUMINT (2) →LEGINT (2) →OSINT (2) →SOCMINT (2) →

🎯 Mission Domains

Child Protection (3) →Extremism & Radicalization (3) →Disinformation / IO (2) →Election Security & PSYOP (1) →

🔍 Lookup

📜 Playbook — URL exploitation

  1. Direction — frame the requirement for URL: what decision does this support, by when?
  2. Collection — pull the 6 mapped sources (6 free) and the native workbench (open); capture provenance and observe OPSEC.
  3. Processing — normalize, de-duplicate and enrich the collected data.
  4. Analysis — correlate against local holdings; apply ACH; assign confidence.
  5. Dissemination — open a case, draft a report, share via STIX/MISP.
  6. Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief⚡ AI SkillsResolveEnrichAuto-CollectHuntReportExport

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case+ CampaignWatchlistTagSave searchWhitelistExport STIX/MISPReport

🧩 Advanced Capabilities

Link AnalysisPivot ExplorerTimelineThreat HuntingAnalyticsDetection RulesBlockchainOSINT PivotPassive DNSTAXII 2.1MISP FeedCreate Alert RuleNetFlowCoverage & Gaps

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Enrichment → local →Integrations →

🎫 URL

A URL is a fully-qualified web resource locator combining scheme, host, path, and query that points to a specific page, payload, or endpoint. In investigations it captures phishing landing pages, malware download and C2 paths, and tracking/exfiltration endpoints, and it decomposes into host, path, and parameter indicators.

Format: RFC 3986: scheme://host[:port]/path[?query][#fragment]. Validate scheme (http/https), percent-encoding, punycode host, and defang notation (hxxp://, [.]).

📡 How it is collected

  • Phishing email links / URL rewrites
  • Proxy and web gateway logs
  • Sandbox detonation network traces
  • URL shortener expansions
  • Threat-feed IOC ingestion
  • Crawling and referrer chains

📚 Enrichment & validation sources

URLScan.io →VirusTotal →Google Safe Browsing →PhishTank →URLhaus →Web Archive (Wayback) →OpenPhish →ANY.RUN →

🔗 Pivot to

Domain Name →IP Address →Subdomain →TLS certificate →file hash (payload) →redirect chain hosts →favicon hash →

🧩 Analysis & hunting techniques

  • URL decomposition (host/path/param analysis)
  • Redirect-chain unwinding
  • Payload detonation and hash extraction
  • Favicon / DOM structural similarity clustering
  • Kit fingerprinting (phishing kit paths)
  • Defang/normalize handling
  • Shortener expansion
  • Live vs. dead / retrohunting

🔧 Tools

  • urlscan.io
  • ANY.RUN
  • CyberChef
  • Burp Suite
  • curl/wget
  • VirusTotal
  • Hybrid Analysis
  • gau/waybackurls

⚡ Workbench actions

  • Detonate URL in sandbox
  • Unwind redirect chain
  • Capture live screenshot (urlscan)
  • Extract & hash delivered payload
  • Screen against phishing feeds
  • Decompose host/path/params
  • Compute favicon hash pivot
  • Query Wayback history

📊 Dashboard KPIs

Malicious verdict count across enginesHTTP status / livenessRedirect hop countAge since first submissionDistinct payload hashes served

📂 Open

URL profile →IOC workbench →Data point profile →Correlate →Hash pivot →Link analysis →

🔄 Data Feeds & Datasets

FeedCategoryFormatStatus
urlscan.io APIReputationjsonenabled
Maltrail MalwareDomains/URLstextenabled
URLAbuseScamtextenabled
abuse.ch URLhaus hostfileMalwaretextoff
abuse.ch URLhaus (text)Malwaretextoff
DigitalSide latest URLsMalware URLstextoff
URLhaus text (online)Malware URLstextoff
URLhaus FullMalware URLscsvoff
URLhaus (tags/family)Malware URLscsvoff
VXVault URLsDomains/URLstextoff
MalwareWorld DomainsDomains/URLstextoff
DigitalSide URLsDomains/URLstextoff
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

⚡ AI Skills

All SkillsResolveEnrichCorrelateSummarize

🔍 Lookup & Enrich

EnrichmentsPivotLink Analysis

📚 Docs & Reports

DocumentationGenerate ReportAPIPlatforms Hub

💡 Recommendations

⚙ Automation

Operations Center

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Mission CommandAdvanced SearchOperations Center