urlscan.io Blog
About
The urlscan.io Blog covers announcements, product news, and tutorials.
Contact
You can contact us at info@urlscan.io for general inquiries and at sales@urlscan.io for questions around our commercial products.
If you need technical support contact us at support@urlscan.io.
For matters of security, please see our Security Page.
Updates
For updates and announcements, subscribe to our newsletter.
Follow us on Twitter:
Highlights
urlscan at CYBERWARCON 2026
Our executive team is attending the conference to get in touch with our customer base and get an opportunity to sit down face to face. Whether you are a customer...
10 years of urlscan.io
From a side project to critical infrastructure for defenders
urlscan.io is ten years old today. It went live in September 2016 as a small side project to scan a suspicious website. Since then, we have scanned more than 2.6...
Announcing urlscan Labs
We just launched the urlscan Labs umbrella in our urlscan Pro platform. With this post, we wanted to give our users some background about what we have launched as part...
All Posts
Intel Brief: Caught in the Crossfire - When an AI Agent Swarm Uses Your Infrastructure to Attack
For approximately 48 hours in June 2026, a cluster of activity that the urlscan Threat Research Team assesses to be a swarm of automated AI agents used urlscan.io as a...
FluxPanel and FastFlux
Nameserver Pivoting Uncovers a UK Banking Phishing Network
The urlscan Threat Research Team identified a suspicious IP address hosting a cluster of phishing sites predominantly targeting UK banks, including HSBC, Lloyds, Metro Bank, Barclays, and Revolut. Pivoting from...
Influencer Phishing
Google Account Credential Harvesting via YouTube Lures
This report documents two closely related phishing clusters identified by the urlscan Threat Research Team, both targeting social media users, primarily YouTube content creators, with the goal of gaining access...
Shared Phishing Framework
Impersonating Prove and Multiple Financial Brands
The urlscan Threat Research Team identified a phishing site impersonating Prove, an identity verification provider, which stood out due to the notable nature of the company being targeted. A single...
CY-Kit
Chinese backed phishing services
CY-Kit represents a dangerous evolution in phishing, moving beyond simple credential harvesting to a “live puppeteer” model where operators control victim sessions in real time via Socket.IO. This Chinese-backed framework...
Oriental Gudgeon aka. "CoGUI"
Chinese backed phishing services
Oriental Gudgeon, also known as CoGUI, has undergone a major architectural shift toward a centralized encrypted wrapper model to mask its global phishing operations. This latest iteration employs defensive anti-analysis...
Darcula aka. "Magic Cat"
Chinese backed phishing services
The Darcula phishing framework continues to evolve, transitioning from early API-driven roots to a sophisticated “Phishing-as-a-Service” model using encrypted WebSockets and wrapper APIs. Our latest research uncovers the inner workings...
Sailor Framework
Chinese backed phishing services
The Sailor Framework has emerged as a highly specialized Chinese-backed phishing ecosystem, moving away from broad industry attacks to dominate a specific vertical: U.S. state government and tolling infrastructure. By...
Beyond the Lure
Uncovering Distinct Phishing Tooling Behind Calendly-Themed Campaigns
Phishing campaigns that impersonate a single brand are often assumed to come from a single source, but that assumption rarely holds up. Calendly is a widely used scheduling platform for...
Subscribe via RSS