0

When I look up a domain of interest on urlscan.io, I see a lot of interesting information.
When I click on "Indicators of compromise" (IOC), I see a list of hashes that are actually links to pages full of information that I don't understand. Example page: https://urlscan.io/search/#hash%3A1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

nothing there seems to have anything to do with the domain I started investigating. So, what is this page and what does it mean for the domain of interest?

  • 1
    Help & Examples says "A resource with this SHA256 was downloaded" – schroeder Oct 5 '18 at 16:59
  • I guess that is what I didn't understand. They are saying malware was potentially downloaded from my domain? – mcgyver5 Oct 5 '18 at 17:02
2

This site uses an unusual understanding of the term IOC (Indicators of compromise). Essentially it just lists all resources it has found on the site, no matter if these actually indicate a compromise or not. Just try some known innocent sites like example.com and you still find "IOC" reported.

  • Wow, yeah. Their IOC page is basically "here's stuff on the page" without any classification at all. – schroeder Oct 5 '18 at 19:19
  • Thanks for the discussion / feedback, I didn't think naming the page "IoCs" would confuse people in that manner. The indicators listed on that page are just that: All domains / IPs / hashes visited by the page. For lack of a better term for a collection of different indicator types I just called it "IoCs". Do you have a better idea? – heipei Oct 22 '18 at 6:34
  • @heipei: IOC stands for indicators of compromise. To avoid confusion the term should not be used unless the hashes etc really indicate a compromise. Otherwise these are just the assets found on this page - maybe "asset indicators" or "resource indicators" ? – Steffen Ullrich Oct 22 '18 at 6:41
1

It's a hashed representation (in SHA256) of the resource in question, potentially malicious. They check and track other domains/URL where the same resource was seen or reported, as an indicators of compromise (IoC).

If they detect the same resource in your target URL/server, they will report it (i.e. the presence of well-known malware file represented by a SHA-256 hash, which in theory should not change since it's a trapdoor-permutation)

VirusTotal does something similar, also add the fact that urlscan.io service utilizes Google's Safe Browsing API:

The Safe Browsing lists consist of variable length SHA256 hashes (see List Contents). To check a URL against a Safe Browsing list (either locally or on the server), clients must first compute the hash prefix of that URL.

When using the Lookup API to check URLs, the client sends the actual URL in the request and Safe Browsing server converts the URL to a hash before performing the check (see Checking URLs for the Lookup API).

https://developers.google.com/safe-browsing/v4/lists

  • There are so many results while virus-total has none and google safe browsing has none. Can we attribute that to over-reporting? – mcgyver5 Oct 5 '18 at 19:07
  • Best to ask urlscan.io folks directly – guerilla7 Oct 5 '18 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.