Lion Cipher Lab
Investigate a suspicious URL with urlscan.io: read the verdict, then pivot to the phishing kit's siblings
- Threat Intel Analyst
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Suspicious links are the number-one way attacks start — MITRE ATT&CK tracks this as Phishing (T1566). The instinct most people never learn is that you can investigate a link WITHOUT clicking it: a sandbox detonates it for you and hands back evidence. Learn to read that evidence and, more importantly, to pivot from a disposable domain to a stable artifact, and one reported email turns into a map of an attacker's whole campaign. That's the difference between a help-desk ticket and threat intelligence.
What you'll learn
- URL sandbox analysis
- reading IOCs (domains, IPs, ASN, TLS, hashes)
- urlscan.io Search pivoting
- phishing kit hunting
- analyst judgment on verdicts
Steps in this lab
- The one rule: don't click — detonate it somewhere else
- Get a safe target to practice on
- Read what the sandbox captured
- Decide: true, suspicious — and when NOT to trust the verdict
- Pivot: use Search to find the kit's siblings
- Do it better: pivot on the artifact that costs the attacker the most
- Ethics and cleanup