Author: Jose Luis Sanchez Martinez, Senior Security Engineer
Introduction
In today's fast-moving cybersecurity landscape, security operations are transitioning from manual, repetitive triage to intelligent, proactive defense. At the core of this transformation are Agentic workflows, which shift AI from a simple conversational assistant into an active, autonomous collaborator.
To power this new paradigm, Agentic threat intelligence in Google Threat Intelligence officially launched in General Availability (GA) in January this year. Agentic threat intelligence provides a multi-language conversational interface that unlocks Google's vast threat intelligence, allowing security analysts to chat with specialized AI agents to accelerate security investigations and obtain immediate threat analysis.
At the same time, traditional URL analysis has been redefined by the VirusTotal launch of URL Scanning 2.0, an update that significantly expands URL analysis capabilities by introducing automated visits with a full browser instance and deeper historical visibility. Instead of relying on static reputation scores alone, URL Scanning 2.0 enriches reports with "under-the-hood" headless browser telemetry, including the DOM, full-page screenshots, web technologies, and network request logs. Crucially, it introduces historical analysis pivoting, giving analysts the ability to pivot from a current report to a historical analysis of a URL to track how a page has changed over time.
This blog post explores the exciting integration of these two breakthrough capabilities. By marrying the reasoning power of Agentic threat intelligence with the rich headless browser telemetry of URL Scanning 2.0, we have unlocked a host of new features designed to supercharge website triage and anti-phishing operations. From generating intuitive AI page summaries similar to urlscan.io to executing timeline analyses that review discrepancies between screenshots, DOM, and domains over time, Agentic threat intelligence is redefining how we investigate the web.
URL Scanning 2.0
To successfully defend against modern, highly adaptive web threats, threat analysts must move beyond basic, binary reputation scores. With the debut of URL Scanning 2.0, Google Threat Intelligence introduces robust headless browser integration that captures how a page behaves dynamically in a clean sandbox environment.
Every scan now generates rich, granular telemetry that provides a blueprint of the target page's execution:
-
Headless Browser Data: Full-page visual screenshots, full DOM (Document Object Model) trees, and web technologies (e.g., Cloudflare, PHP, HTTP/3).
-
Page and Network Statistics: Highly detailed counters of individual network requests, encrypted HTTPS transactions, unique contacted domains/subdomains, and serving IP address mappings with geographic tracking.
-
Anti-Phishing Fingerprints: Automatic identification of brands, cloned-website tags, password input fields, tracker IDs, and favicon dhashes.
-
Historical Pivoting: A timeline containing historical analyses of a URL with its corresponding risk score, allowing analysts to track exactly how its metadata and content have shifted over time.
Here is a practical breakdown of what analysts can expect:
Public Access (Free for VirusTotal Users) The core enhancements of the URL Scanning 2.0 engine are available to everyone, but free users are restricted to viewing data exclusively from the most recent analysis. For this latest scan, analysts can access rich telemetry generated by headless browser execution. This includes visual screenshots of the rendered page, full DOM captures, extracted JavaScript globals, console messages, and a list of all loaded network resources and outgoing links.
VirusTotal Premium Customers For paid VirusTotal customers, the platform unlocks deeper retrospective capabilities. Instead of just seeing the latest scan, analysts have the ability to pivot to and review the full historical analyses of a URL as it was observed at specific points in time in the past. Furthermore, premium access unlocks advanced infrastructure relationships, allowing users to pivot on contacted domains, contacted IPs, and downloaded files associated with the URL.
Google Threat Intelligence Customers The highest tier of analysis adds AI-driven context and actionability. Users with access to Google Threat Intelligence unlock Automatic Brand Identification, which visually detects spoofed brands, alongside the proprietary Google Threat Intelligence Assessment. Moreover, Google Threat Intelligence clients can leverage Agentic threat intelligence to directly interact with all this data. Analysts can use natural language prompts to pivot on DOM elements, historical resolutions, or specific JavaScript variables. It is important to note that these Agentic capabilities are exclusively available to Google Threat Intelligence customers and are not included in standard VirusTotal subscriptions.
Investigating a phishing campaign
To showcase some of the new capabilities we have integrated into URL Scanning 2.0, we will walk through examples of common phishing campaigns. Rather than just relying on static reports, these new features allow analysts to see the rendered page, trace its execution, and track its evolution over time.
In our first example, we analyzed an interesting campaign targeting the financial industry. Let's look at how URL Scanning 2.0 works.
Initially, when an analyst navigates to the mentioned URL to view the report generated by Google Threat Intelligence, they would see something similar to the following with the new URL Scanning features:
URL Report for the phishing site
At the top of the interface, we can see that the URL has been scanned three times. This means there are three distinct reports for the same URL, each potentially containing different information that could be highly useful for an analyst. In the top right corner, we can view these past analyses by clicking on "History".
This is where the new historical analysis pivoting comes into play: it allows analysts to travel back through a URL's timeline with point-in-time snapshots.
History for the URL analyzed
By clicking on "History", we can view all the historical analyses for that URL, including response codes, detections, screenshots, and other metadata. You can also apply filters to narrow down the timeline and view only the historical records you are interested in, based on specific response codes, URL actions, and other criteria.
In this case, if we click on the initial historical analysis performed on July 6, 2026 (as shown in the screenshot above), we can examine its specific information across the "Summary", "Details", and "Detection" tabs. A key feature of URL Scanning 2.0 is that the information within these report tabs will dynamically re-render to match the exact historical state of the snapshot you select.
Different Page Stats for each history selected
History which contains screenshot related to the phishing
As observed in the history timeline, after clicking on this specific analysis included a live screenshot and other relevant metadata, indicating the scan occurred while the website was fully operational and actively distributed. The previous screenshot gives us a clear view of how the phishing page was visually structured.
Furthermore, diving into the "Details" tab reveals other interesting technical artifacts from the campaign. These details are incredibly useful for pivoting and identifying new malicious URLs that share similar characteristics.
More details extracted for the first analysis
Among the wealth of information generated by URL Scanning 2.0, analysts will find HTTP transactions, detected JavaScript variables, console messages, external outbound links, and other critical metadata. These key technical markers serve as pivotable and searchable attributes, allowing teams to conduct advanced footprint hunting and instantly find other malicious URLs exhibiting the exact same technical fingerprint.
Details obtained by URL Scanning 2.0
Furthermore, every snapshot taken during each analysis provides the complete Document Object Model (DOM) tree captured by the full browser instances. It allows you to inspect the exact structure of the page as it was dynamically rendered to the victim, exposing elements that static scans might miss. As can be seen in the following image, having direct access to this point-in-time DOM data empowers analysts to dig deep into the page's architecture.
DOM content obtained by URL Scanning 2.0
Agentic + URL Scanning 2.0
Hunting phishing sites
All of this new URL Scanning 2.0 functionality has been integrated with our Agentic system. Analysts can now have natural language conversations to gain deeper insights from the data obtained via URL Scanning 2.0, perform seamless pivoting, and conduct advanced threat hunting.
Using the previous phishing example, we conducted an exercise to identify other potential URLs that might belong to the same campaign. Through this, we discovered that the campaign was not solely focused on one financial institution, but also targeted cryptocurrency exchange phishing websites.
Our first action was to ask the agent to evaluate the history and activity window of this link, using the following prompt:
I'm investigating a phishing campaign targeting <a major financial institution>. I've initially identified this URL. Could you tell me what information it has presented historically and when it was active?
http://REDACTED.com/
Agentic began working immediately, executing multiple searches for indicators of compromise (IOCs) and evaluating telemetry within the VirusTotal database. In a short amount of time, it delivered a comprehensive threat analysis detailing the financial institution phishing campaign.
Initial findings:
-
Activity Timeline: Agentic discovered that the domain was registered and first submitted to VirusTotal on July 5, 2026.
-
Historical Presentation and Content: When the site was active, it presented a spoofed login portal designed specifically to harvest user credentials.
-
Discovery of External Dependencies: One of the most revealing technical details was that the page relied on static assets (such as images and backgrounds) hosted on a third-party domain: jiaoyisuo.thai2570[.]com.
Part of the Agentic response
Agentic did not limit itself to delivering a static analysis; instead, it performed automatic pivoting based on the response hashes. By pivoting on the response body hash and the Favicon dhash, Agentic managed to uncover a much broader and highly correlated phishing infrastructure.
In this way, new related malicious domains came to light:
-
Domains such as REDACTED1.eu[.]cc used the exact same HTML template as the original target site.
-
Domains such as REDACTED5[.]net shared an identical Favicon graphic to that of the targeted bank.
Part of the Agentic response with a graph to explain better the relationships
Armed with the knowledge that the attackers were loading external resources from the domain jiaoyisuo.thai2570[.]com, we knew we had found a thread to pull. We wanted Agentic to do the heavy lifting of threat hunting and correlation, so our next question was this:
Based on the metadata of the URL, outgoing links and other information related to the initial URL, can you do pivoting, run queries and provide queries to identify other potential URLs related?
Once you have results, explain them.
Agentic accepted the challenge and structured its hunt into two primary pivoting strategies, explaining its findings to us step by step.
Strategy 1: Outbound Link and Content-Based Search
Agentic deduced that if the initial page was loading images from jiaoyisuo.thai2570[.]com, it was highly likely that other fraudulent pages built with the same phishing kit were doing exactly the same. Threat actors frequently reuse infrastructure and web assets to deploy campaigns faster, inadvertently creating a traceable fingerprint across the internet. To test this hypothesis, the agent executed the following advanced query in VirusTotal:
entity:url (outgoing_link:jiaoyisuo.thai2570.com OR content:jiaoyisuo.thai2570.com)
The results were revealing and demonstrated that we were not just looking at a single isolated attack, but rather a large-scale, multi-brand operation:
-
Banking Cluster: Agentic found an identical replica of the phishing campaign targeting the bank, but hosted on alternative top-level domains such as REDACTED1.eu[.]cc.
-
Cryptocurrency Cluster (Coinxsg): The cybercriminals behind thai2570[.]com were not limited to banking institutions; they also operated fake cryptocurrency exchange portals, such as coinxsg[.]biz.
-
Cryptocurrency Cluster (Coinbase): Additionally, it discovered typosquatting domains (like max-coinbse[.]com) designed to compromise Coinbase users.
Queries ran by Agentic
Strategy 2: Pivoting on the Hosting Domain
To better understand the infrastructure behind the delivery of these assets, Agentic performed a direct search of the domain
entity:domain "thai2570.com"
This analysis broke down a highly segmented subdomain tree, where each one fulfilled a specific purpose within the phishing machinery:
-
jiaoyisuo.thai2570[.]com: This was used strictly to host images and layouts for the active phishing sites (interestingly, Agentic informed us that "jiaoyisuo" translates to "exchange" in Mandarin).
-
pay.thai2570[.]com: Dedicated to managing transactional or payment capture pages.
-
bot.thai2570[.]com and telemonitor.thai2570[.]com: These subdomains strongly indicated the use of administrative backend components, possibly acting as Telegram bot gateways to exfiltrate the stolen credentials.
-
dzadmin.thai2570[.]com: Operated as the backend for the phishing control panel.
Queries ran by Agentic
Devil NFC with Agentic
Following our initial successes, we turned our attention to a completely different type of threat: mobile financial fraud. Specifically, we focused on a banking trojan from the NGate family—often referred to as "Devil NFC"—which bypasses traditional credential theft by physically relaying a victim's contactless card data to an attacker in real time. We had an initial, highly suspicious URL (hxxps://reventandocajerosnfc[.]club/) and we needed to understand its purpose and history.
Content related to the reventandocajerosnfc[.]club domain
Investigate URL https://reventandocajerosnfc.club/ which I suspect is related to malware. Tell me if it's something related to malware, if positive:
Report up to when this site was active
Agentic quickly correlated the data and provided a comprehensive threat summary, confirming our worst suspicions. Right away, the agent analyzed the domain name itself, noting that it translates from Spanish as "popping/exploding NFC ATMs", a blatant indicator of financial fraud.
Initial findings by Agentic were:
-
Malicious Classification: Agentic confirmed the URL was classified as malicious with medium severity, as 17 security vendors flagged the indicator.
-
Activity Timeline: Agentic analyzed the historical scanning timeline and concluded that the site was active up until approximately April 27, 2026. By May 19, 2026, the backend infrastructure was disabled or terminated, returning a Cloudflare Connection Timed Out error.
-
Key Endpoints: It also discovered a secondary backend configuration file, api_config.php, likely used to facilitate data transmission from compromised apps to the control panel.
Analysis history of the requested URL
Pivoting: Mapping the "Devil NFC" Infrastructure
To transform this single data point into a broader threat landscape view, we needed to pivot. We asked Agentic to dig deeper into the historical analysis patterns:
Please analyze the details of different analysis history to get interesting patterns that can be used to run new queries and identify potential URLs related to this campaign.
Agentic's pivoting capabilities shined here. By examining the HTML structure, JavaScript variables, and visual assets of the inactive site, it successfully mapped out a much larger infrastructure known as Devil NFC.
Discoveries from the Pivot:
-
Brand Identification: When active, the site displayed the brand name "Devil NFC" with the custom HTML title: Devil NFC - [ CLASSIFIED SYSTEM ].
-
Code-Level Tracking: Agentic identified interesting JavaScript variables, like drawMatrix, indicative of a retro matrix hacker aesthetic panel.
-
Uncovering Sister Nodes: By using these unique artifacts as search modifiers, Agentic discovered new, related infrastructure. This included domains like spicynagets[.]shop (an active threat host with 22 malicious detections) and nfkracking[.]com, which showed a clear thematic correlation to NFC/RFID cracking.
New URLs discovered by Agentic
With the primary C2 domains mapped out, we wanted to move beyond just top-level hostnames and understand the structural properties of the attacker's infrastructure. We needed to know exactly how the malware was communicating with the panel.
To achieve this, we tasked Agentic with a multi-step analysis focused on URL paths and structural overlaps. We submitted the following prompt:
Please perform the following tasks based on the discovered domains:
1. Analyze their URLs and structural properties.
2. Extract overlapping technical patterns (e.g., specific file paths, parameters, or headers).
3. Write a Livehunt rule based on these patterns to automatically detect emerging infrastructure tied to this campaign.
The results from this analysis were interesting. Rather than just returning basic network metadata, Agentic successfully extracted the specific file paths used by the operators. Most notably, it discovered a secondary related endpoint at /api_config.php. The system identified that this specific path represented a backend configuration file, which likely served as the main channel to facilitate data transmission from the compromised NFC apps back to the control panel.
By pinpointing these overlapping paths and technical patterns, Agentic handed us exactly what we needed to draft a robust Livehunt rule, allowing us to pivot from analysis to proactive detection of any new infrastructure the "Devil NFC" operators might spin up in the future.
Paths identified by Agentic related to this campaign
Mapping the attacker's infrastructure and understanding their backend paths gave us a significant advantage, but we needed to translate these findings into actionable, proactive defense. To catch the "Devil NFC" operators the moment they attempt to deploy new infrastructure, we submitted one final prompt to Agentic:
With this information, I would like to create a high fidelity YARA rule to monitor new URLs uploaded to virustotal based on the API paths discovered
Agentic instantly generated a comprehensive rule named Devil_NFC_Path_Only_URL. What makes this rule particularly powerful is that Agentic didn't just look for a single string; it designed a multi-branch boolean condition that targets three different layers of the campaign's structural footprint.
YARA Rule created by Agentic
It is also worth noting that Agentic allows the creation of YARA rules using the vt module, as well as generating rules based on network locations (netloc). This enables advanced detections leveraging both rich telemetry and network infrastructure.
Conclusion: The Future of URL Investigations
The integration of URL Scanning 2.0 and Google Threat Intelligence Agentic represents a paradigm shift in how security analysts investigate web-based threats. As demonstrated by our deep dives into the banking phishing cluster and the Devil NFC malware campaign, investigations are no longer limited to static verdicts.
By surfacing powerful metadata directly inside the workflow—such as historical DOM captures, live screenshots, and pivotable technical identifiers—analysts can now turn a single indicator into a comprehensive infrastructure map in a matter of minutes.
Log in to VirusTotal to explore the new URL Scanning 2.0 features today. If you'd like to see how Google Threat Intelligence and Agentic can automate your complex investigations, contact our team to learn more. Already a Google Threat Intelligence customer? Try Agentic now and let us know your feedback!
