What
Add an observable analyzer for ScanMalware, an archive of sandboxed URL
scans. It supports domain, url and ip.
Why
It answers a question the current analyzer set mostly doesn't: what did a browser actually see when
it visited this? For a domain it returns scan statistics and the scans in which the domain was
observed, for an IP the domains seen on that address in Certificate Transparency, and for the most
recent scan its indicators, the platform's risk verdict and an AI classification.
The API is anonymous, so it works with no key and belongs in FREE_TO_USE_ANALYZERS.
Notes
Read-only by design: it never submits an observable for a new scan, because a submitted URL becomes
publicly listed in the archive, which is not a side effect an enrichment run should have.
I maintain ScanMalware, so this is a vendor-proposed analyzer. Happy to have it judged on that basis.
What
Add an observable analyzer for ScanMalware, an archive of sandboxed URL
scans. It supports
domain,urlandip.Why
It answers a question the current analyzer set mostly doesn't: what did a browser actually see when
it visited this? For a domain it returns scan statistics and the scans in which the domain was
observed, for an IP the domains seen on that address in Certificate Transparency, and for the most
recent scan its indicators, the platform's risk verdict and an AI classification.
The API is anonymous, so it works with no key and belongs in
FREE_TO_USE_ANALYZERS.Notes
Read-only by design: it never submits an observable for a new scan, because a submitted URL becomes
publicly listed in the archive, which is not a side effect an enrichment run should have.
I maintain ScanMalware, so this is a vendor-proposed analyzer. Happy to have it judged on that basis.