Agentic now leverages VirusTotal's sandboxed browser execution to analyze suspicious URLs dynamically.
Capabilities:
- Runtime Telemetry: Captures dynamic DOM modifications, network requests, and global JavaScript variables.
- Campaign Mapping: Fingerprints phishing kits (e.g. pivoting on
__jwrAuthvariables) to map related threat infrastructure.
URLs that are not in the public corpus of Google Threat Intelligence are analyzed privately using Private Scanning.
Example Prompt: "Investigate hxxps://t-mobile.zyhqxp.top/pay/ and find other URLs from the same campaign using its JS footprint. Then create a campaign collection."
View this conversation in Agentic →
What This Means for You
As security analysts, we've all been trapped in the endless game of "whack-a-mole": you block one malicious URL, and the threat actor spins up three more before you can even close the ticket. Historically, dissecting these evasive campaigns required spinning up local sandbox environments, manually parsing raw code, and hoping you didn't miss a dynamic redirect.
With Agentic URL Scanning 2.0, We are changing the rules of the game.
By combining Google Threat Intelligence (GTI) with VirusTotal's sandbox browser detonation, our AI agents don’t just read code—they dynamically interact with it. Here is what this looks like in your daily operations:
Stop chasing single links; block the whole campaign: Instead of chasing individual indicators, you can pivot on dynamic fingerprints (like unique JavaScript variables) to unmask the attacker's entire infrastructure in seconds.
Analyze in complete safety and privacy: You get deep, live telemetry on suspicious URLs—including Tor-hosted onion domains—privately. Your investigations remain hidden from threat actors without you having to build or manage an isolated malware lab.
Accelerate time-to-insight: What used to take hours of manual reverse-engineering is now accomplished with a simple, conversational prompt.
The Bottom Line: This upgrade shifts your security operations from reactive triaging to proactive threat demolition, giving your defenders the speed and context needed to outsmart modern threat actors.
