<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-url-reputation
description: >-
  Analyze URLs for phishing and malicious indicators. Covers URL structure
  decomposition, reputation service lookups, redirect chain analysis,
  homograph detection, and URL defanging for safe sharing.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - url-analysis
  - url-reputation
  - threat-intelligence
  - phishing-urls
  - redirect-chains
  - homograph-attacks
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.002"]
---

# Analyzing URL Reputation

## Overview

URL analysis is critical for phishing defense — attackers use URL shorteners,
redirect chains, homograph attacks, and legitimate hosting services to evade
detection. This skill covers URL decomposition, reputation checking against
multiple threat feeds, redirect chain tracing, and automated classification
of suspicious URLs.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| `requests` | `pip install requests` |
| `curl` | HTTP redirect tracing |
| VirusTotal API key | URL reputation lookups |
| URLhaus API | Malware URL database |

## Key Concepts

### URL Decomposition

```
https://login.microsoft-verify.com:8443/auth/signin?user=target@company.com#token

scheme:   https
host:     login.microsoft-verify.com
port:     8443
path:     /auth/signin
query:    user=target@company.com
fragment: token
```

### Suspicious URL Indicators

| Indicator | Risk | Example |
|---|---|---|
| Brand in subdomain | High | `microsoft.evil.com` |
| IP address as host | High | `https://192.168.1.1/login` |
| Excessive subdomains | Medium | `login.auth.verify.security.com` |
| Unusual port | Medium | `:8443`, `:4443` |
| URL shortener | Medium | `bit.ly/xyz`, `t.co/abc` |
| Homograph characters | High | `mícrosoft.com` (IDN) |
| Data URI | Critical | `data:text/html;base64,...` |
| Long random path | Medium | `/asd8f7g6h5j4k3l2/login` |
| Known phishing TLD | Medium | `.xyz`, `.tk`, `.top` |

### Redirect Chain Evasion

```
Email Link → URL Shortener → Legitimate Redirect → Phishing Page

Example:
1. bit.ly/3xK9pQ2
2. → google.com/url?q=https://evil.com/login
3. → evil.com/login
4. → evil.com/harvest.php (credential capture)
```

## Workflow

### 1. URL Decomposition

```bash
# Parse and decompose a suspicious URL
node agent.js decompose "https://login.microsoft-verify.com/auth?u=target"

# Batch analyze multiple URLs
node agent.js batch-analyze /tmp/urls.txt
```

### 2. Redirect Chain Analysis

```bash
# Trace redirect chain (safely — HEAD requests only)
curl -sIL -o /dev/null -w '%{url_effective}\n' "https://bit.ly/example"

# Full redirect chain with status codes
curl -sIL -D - "https://bit.ly/example" 2>/dev/null | grep -iE '^(HTTP/|Location:)'

# Automated redirect tracing
node agent.js trace-redirects "https://bit.ly/example"
```

### 3. Reputation Lookup

```bash
# Check URL against threat feeds
node agent.js check-reputation "https://suspicious-url.com/login"

# URLhaus lookup
curl -s -d "url=https://suspicious-url.com" https://urlhaus-api.abuse.ch/v1/url/

# VirusTotal URL scan
# curl -s "https://www.virustotal.com/api/v3/urls" \
#   -H "x-apikey: ${VT_API_KEY}" \
#   -d "url=https://suspicious-url.com"
```

### 4. Defanging for Safe Sharing

```bash
# Defang URL for safe sharing in reports/tickets
node agent.js defang "https://evil.com/malware.exe"
# Output: hxxps://evil[.]com/malware[.]exe

# Refang for analysis
node agent.js refang "hxxps://evil[.]com/malware[.]exe"
```

## Detection

```yaml
title: Url Reputation Detection
id: 9a7674b8-3baa-406f-a5f7-bfec1afa2b7d
status: experimental
description: Detects suspicious activity related to analyzing url reputation techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566.002
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| URL decomposed | Scheme, host, path, query extracted |
| Redirect chain traced | All hops documented with status codes |
| Reputation checked | Queried against VT, URLhaus, PhishTank |
| Homograph detected | IDN characters flagged |
| IOCs defanged | URLs safe for sharing in reports |
| Final destination identified | Terminal URL after all redirects |

## References

- [VirusTotal URL API](https://developers.virustotal.com/reference/url-info)
- [URLhaus API](https://urlhaus-api.abuse.ch/)
- [PhishTank API](https://phishtank.org/developer_info.php)
- [Google Safe Browsing API](https://developers.google.com/safe-browsing)
- [RFC 3986 — URI Syntax](https://datatracker.ietf.org/doc/html/rfc3986)
