CheckPhish URL Scanner and Sandbox
The CheckPhish connector enables automated URL scanning and threat detection, integrating with Swimlane Turbine to enhance cybersecurity operations.
CheckPhish is a cutting-edge threat detection service that specializes in identifying and analyzing phishing URLs in real-time. This connector enables Swimlane Turbine users to automate the process of scanning URLs for phishing threats and retrieving detailed analysis results. By integrating with CheckPhish URL Scanner and Sandbox, security teams can quickly perform quick or full scans on URLs and obtain scan results, including insights, directly within the Swimlane platform. This enhances the efficiency of threat detection workflows and accelerates response times to potential phishing attacks.
CheckPhish Detects and Monitors Phishing and Scam Sites With CheckPhish, you can scan suspicious URLs and monitor for typosquats and lookalikes variants of a domain. It is a free real-time URL scanner providing deep threat intelligence, including screenshots, certificates, DOM Tree, and hosting details.
Prerequisites
To effectively utilize the CheckPhish URL Scanner and Sandbox connector with Swimlane Turbine, ensure you have the following:
- CheckPhish API Authentication with these parameters:
- URL: The endpoint for the CheckPhish API services.
- API Key: Your unique key to access the CheckPhish API.
Capabilities
The CheckPhish URL Scanner and Sandbox connector provides the following capabilities:
- Quick scan
- Full Scan
- Get Scan Results
API Documentation
For more information on CheckPhish : CheckPhish URL Scanner and Sandbox API Documentation
Configurations
CheckPhish API Authentication
CheckPhish URL Scanner and Sandbox API Authentication.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
apiKey | CheckPhish API Key | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get Scan Results
Retrieve the scan results for a specific jobID from CheckPhish URL Scanner and Sandbox.
Endpoint
- URL: /api/neo/scan/status
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
jobID | string | Optional | Unique identifier |
insights | boolean | Optional | Parameter for Get Scan Results |
Input Example
{"json_body":{"jobID":"8395ec8d-c031-468f-92f6-f6da6dfcb602","insights":true}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
job_id | string | Unique identifier |
status | string | Status value |
url | string | URL endpoint for the request |
url_sha256 | string | URL endpoint for the request |
disposition | string | Output field: disposition |
brand | string | Output field: brand |
insights | string | Output field: insights |
resolved | boolean | Output field: resolved |
screenshot_path | string | Output field: screenshot_path |
scan_start_ts | number | Output field: scan_start_ts |
scan_end_ts | number | Output field: scan_end_ts |
error | boolean | Error message if any |
image_objects | array | Output field: image_objects |
categories | array | Output field: categories |
Output Example
{"status_code":200,"response_headers":{"Date":"Tue, 27 Aug 2024 12:44:06 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","vary":"Origin, Accept-Encoding","access-control-allow-credentials":"true","x-xss-protection":"1; mode=block","x-frame-options":"SAMEORIGIN","strict-transport-security":"max-age=15552000; preload","x-download-options":"noopen","x-content-type-options":"nosniff","etag":"W/\"278-VBDymiy461HLWKsPcguqdHBh5sU\"","CF-Cach...
Quick and Full Scan
Perform either a Quick or Full Scan on a specified URL with CheckPhish, tailored to the scan type selected.
Endpoint
- URL: /api/neo/scan
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
urlInfo | object | Optional | URL endpoint for the request |
urlInfo.url | string | Optional | URL endpoint for the request |
scanType | string | Optional | Type of the resource |
Input Example
{"json_body":{"urlInfo":{"url":"http://webidlogin101997.5gbfree.com/"},"scanType":"quick"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
jobID | string | Unique identifier |
timestamp | number | Output field: timestamp |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 16 Aug 2024 10:02:36 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","vary":"Origin, Accept-Encoding","access-control-allow-credentials":"true","x-xss-protection":"1; mode=block","x-frame-options":"SAMEORIGIN","strict-transport-security":"max-age=15552000; preload","x-download-options":"noopen","x-content-type-options":"nosniff","etag":"W/\"4a-eFXiGNFs600kB7CMgRA0tGg1iHk\"","CF-Cache...
Response Headers
Header | Description | Example |
|---|---|---|
access-control-allow-credentials | HTTP response header: access-control-allow-credentials | true |
alt-svc | HTTP response header: alt-svc | h3=":443"; ma=86400 |
CF-Cache-Status | HTTP response header: CF-Cache-Status | DYNAMIC |
CF-RAY | HTTP response header: CF-RAY | 8b4096f10f9a79ee-HYD |
Connection | HTTP response header: Connection | keep-alive |
Content-Encoding | HTTP response header: Content-Encoding | gzip |
Content-Type | The media type of the resource | application/json; charset=utf-8 |
Date | The date and time at which the message was originated | Fri, 16 Aug 2024 10:02:36 GMT |
etag | An identifier for a specific version of a resource | W/"4a-eFXiGNFs600kB7CMgRA0tGg1iHk" |
Server | Information about the software used by the origin server | cloudflare |
Set-Cookie | HTTP response header: Set-Cookie | __cf_bm=fCvkUrFdtBI.NWRLr299pWOq.wCUO0IGWy__c.cVjNA-1723802556-1.0.1.1-9K4LARqp3T0HmaJgosa.cy655U0xhzHBfr7TU5iNvq.ih2ZJLmW0fB83zyUqXsUT2oY86xg.pGhr9Ekcbk9YcQ; path=/; expires=Fri, 16-Aug-24 10:32:36 GMT; domain=.bolster.ai; HttpOnly; Secure; SameSite=None |
strict-transport-security | HTTP response header: strict-transport-security | max-age=15552000; preload |
Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked |
vary | HTTP response header: vary | Origin, Accept-Encoding |
x-content-type-options | HTTP response header: x-content-type-options | nosniff |
x-download-options | HTTP response header: x-download-options | noopen |
x-frame-options | HTTP response header: x-frame-options | SAMEORIGIN |
x-xss-protection | HTTP response header: x-xss-protection | 1; mode=block |