Threat Intelligence

Each tool profile documents the patterns, behaviors and implementation details that identify it. We believe that this provides greater value than long lists of hostnames and IP addresses. However, we do also link to representative samples on urlscan.io, which include example domains and payloads.

No. Attackers rotate phishing domains so quickly that a feed of past detections has little blocking value. Instead, we want to help researchers, incident responders and analysts identify the most prevalent browser attack tools and understand how they work.

Tools are given their public kit name if known, but we identify many kits in our detections that have no public attribution. Some names are therefore internal codenames we use to track the kits. If you think one maps to a public kit, let us know.

Not yet. Push customers can contact us to check whether a URL matches a known tool.