π Scan results now name the website builder a page was made with, including AI app builders such as Lovable, v0, Bolt and Base44, and list the project ID the builder leaves on the page as a tracking ID, so other sites built from the same project are one search away. Technology detection also recognises more of the technologies a page uses
#scanmalware β Public Fediverse posts
Live and recent posts from across the Fediverse tagged #scanmalware, aggregated by home.social.
-
π New detection for the operator panel of a malicious browser extension used by a banking trojan, and more precise detection of fake task-and-earn crypto apps
-
π The pivot graph now shows each site once, offers tree, radial, concentric, circle and grid layouts, and keeps large graphs readable
-
π Improved Security Verdict and AI Security Verdict accuracy, and script analysis now covers more of the scripts a page loads
-
π Cool new feature at Scan Malware:
You can now explore relationships between websites using interactive graph visualizations, with multiple layout options
This makes it easier to discover connections between malicious websites that share common indicators, even when they're one or two hops away
The feature is on the "Pivot" tab β‘ and click "Open in graph". Also useful in OSINT investigations
#CyberSecurity #ThreatIntelligence #MalwareAnalysis #OSINT #GraphVisualization #ThreatHunting #ScanMalware
-
π Scan results now say when the scanned address returned something other than a web page, such as an API response, a PDF, an image, an archive or a program download, and the AI Security Verdict describes it as what it is
-
π New pivot graph: start from any public scan and see which other sites share its titles, favicons, tracking IDs, scripts and threat labels, drawn as a graph you can drag, expand, filter and view full screen. It opens two steps out, so sites one or two hops away show up at once, and a graph can be saved as an image or as JSON. Open it from the Pivot tab of a scan result
-
π Search: a hostname typed with a trailing dot, such as example.com., now finds the same scans as the name without it
-
π Scan results: the Browser APIs view now lists other sites whose pages used nearly the same set of browser features, which usually means they were built with the same kit, template or site builder, with how close each match is and its AI Security Verdict. The Pivot tab and the new js_feature_similar: search filter find the same pages
https://scanmalware.com/search-advanced?q=js_feature_similar:eee2241f-f189-4686-9464-97526e2e3ae5
-
π Improved capture of websites that are only available over plain HTTP
-
π While a scan runs, the result page now lists each analysis step as it finishes, so you can see what is done and what is still running
-
π New detection for fake meeting-app updates and fake document pages that install remote-access software, wider coverage of an exploit-kit loader and of live phishing operator panels, and a label for pages that load an affiliate cookie-stuffing script
-
π Improved AI Security Verdict accuracy, and more domains now show their registration date in scan results
-
π Improved Security Verdict and AI Security Verdict accuracy, with fewer false alarms on web3 apps that connect a crypto wallet
-
π Large inline scripts are now fingerprinted in full, so script pages and script search match pages that embed the same large script more reliably
-
π The Deobfuscation tab decodes more scripts, including code hidden by the virtual-machine obfuscation some phishing kits use and scripts embedded in SVG images
-
π Scan results: the Browser APIs view now notes when a page fingerprints the browser - measuring the audio stack, graphics card, canvas or other device details that can recognise a visitor without cookies - and lists the techniques it used. Anti-bot checks, ads and analytics do this routinely, so it is information, not a verdict. Find such pages with has:browser_fingerprinting
-
π Scan results: the Pivot tab offers more ways to find related pages - hashes of inline scripts, script hashes that still match after a script is reformatted or partly rewritten, the WebAssembly library or vendor module a page runs, URLs revealed by decoding an obfuscated script, how heavily a page's scripts are obfuscated, rarely used browser features and the names of malicious script patterns
https://scanmalware.com/result/3b7500b0-5aab-40d2-9354-188dc263722d#pivot
-
π Improved search: similar_to always includes exact copies of the script it starts from, wasm_host also finds hosts a WebAssembly module reveals when it runs, obfuscator accepts aaencode and jsfuck, and js_feature recognises the browser features added in recent Chrome versions
-
π New detection for several phishing kits, exploit-kit loaders and ClickFix variants, and fewer false matches on articles and research pages that describe these threats
-
π Faster search: very common words, text in screenshots and nameserver wildcards return in seconds, and scan results, screenshots and previews load faster
-
π The Deobfuscation tab decodes more scripts: it opens on a readable copy, unpacks XOR-encrypted loaders and base64-encoded strings into layers of their own, and says why a script stayed encoded. The Obfuscation tab on scan results lists what the deobfuscator found, with a link to each script, and WebAssembly module pages recognise more kinds of modules
-
π Improved Security Verdict and AI Security Verdict accuracy, with fewer false alarms on websites' own sign-in pages and clearer explanations of why a page was flagged