ScanMalware
Supported by community
Infrastructure & Attack Surface Visibility
Detection & Response Enablement
Overview
Enriches URL, domain and IP observables with ScanMalware sandboxed scan results, YARA matches, TLS certificates and JARM or favicon infrastructure pivots.
ScanMalware is a free sandboxed URL scanner. It renders a submitted URL in an instrumented headless browser, records the network, TLS, JavaScript and rendering behaviour, and publishes the result to a public archive of more than 549,000 scans.
The integration enriches URL, domain, hostname and IP observables in OpenCTI with the ScanMalware verdict, the observed infrastructure, the TLS certificate and any YARA rule that matched. It also pivots on JARM and favicon hashes to surface sibling hosts that fingerprint identically.
The ScanMalware API is public and unauthenticated, so the connector works with no credential configured. An optional API key only raises the rate limit.