Lion Cipher Lab
Analyze a suspicious URL safely (without clicking it)
- SOC Analyst / Blue Team
- Beginner
- ~30 min
- Free · no account required
Why it matters
The suspicious link is the single most common attack you will personally meet — in a phishing email, a fake delivery text, a too-good-to-be-true ad. The instinct is to click "just to see what it is," and that instinct is exactly what attackers count on: one click can hand over your password on a convincing fake login page, or start a download, or simply confirm to the sender that your address is live and worth targeting again. The skill that replaces the click is small and completely free. You can defang the link so it can't be opened by accident, read its structure for the tells of a fake,…
What you'll learn
- defanging a URL
- reading URL structure
- using urlscan.io
- using VirusTotal for URLs
- checking domain reputation
- OSINT hygiene (look, don't click)
- reading the limits of a 'clean' result
Steps in this lab
- First, what a URL even is — and why you never click a suspicious one
- Defang it so it cannot be clicked — by you or a tool
- Read the URL like a map before any tool touches it
- Search before you scan — the link may already have a verdict
- Let a sandbox visit it for you: submit to urlscan.io
- Cross-check the destination on VirusTotal
- The honest limits: a clean result is not proof of safe
- Why looking instead of clicking is the whole habit