Before
An analyst would likely search each domain across several threat-intelligence, reputation, browsing-safety, and domain-information sources one at a time. They would then compare the returned information, retrieve additional URLScan details when available, and copy the relevant findings into a common record for review.
How it works
- Process each configured domain individually and search it across web, reputation, and threat-intelligence sources.
- Automatically check whether a URLScan result exists and retrieve the result only when available, while continuing with the remaining investigations.
- Consolidate domain age, reputation, compromise, safe-browsing, parked-domain, and related findings into a structured result for analyst assessment.
Workflow details
- Domain Processing: The workflow starts with a configured list of domains and processes each domain individually, keeping the investigation organized on a per-domain basis.
- Web and Reputation Checks: It searches URLScan and VirusTotal for domain-related results, checks domain reputation and age, and retrieves additional domain information from Host.io.
- Threat Indicators: The workflow checks whether a domain has been flagged by Google Safe Browsing, assesses parked-domain signals, and queries whether the domain has ever been compromised.
- Conditional Investigation: When a URLScan result exists, the workflow retrieves the corresponding result details; when no result exists, it continues with the other domain checks instead of attempting that retrieval.
- Structured Results: After the source checks are completed, the workflow prepares a domain-level result containing fields for domain age, URLScan verdict, reputation, popularity indicators, malware-related reputation, parked score, safe-browsing flags, compromise status, and other investigation attributes.
What changed
Each domain is now investigated through the defined source checks in a consistent sequence, with the URLScan follow-up handled automatically when a result exists. The resulting indicators are organized into a single domain-level output, leaving analysts to interpret the evidence rather than perform the repeated lookups and compilation themselves.
Work removed
Repeatedly searching each domain across multiple investigation sources, checking whether a URLScan result exists, retrieving available result details, looking up domain age and reputation, checking compromise and safe-browsing indicators, and copying findings into a structured domain record.
Expected outcome
One consolidated investigation record is produced per domain, with up to nine source checks or follow-up actions handled automatically for each domain when all applicable results are available.
