urlDNA.io scans URLs and records what’s behind them: page content, screenshots, redirects, certificates, hosting details, technologies and more. Every scan is searchable, which makes it a handy tool for phishing investigations and OSINT.
This guide explains how search works. The original version is on the urlDNA blog.
Direct search
Type a word in the search bar and urlDNA returns all the submitted URLs that contain it. For example, example finds every submitted URL containing “example”.
Custom query language
For more precise searches, use the query language. Each condition has this form:
ATTRIBUTE OPERATOR VALUEAttributes
| Attribute | Description |
|---|---|
domain | Scanned domain |
submitted_url | Submitted URL |
target_url | Final URL, after redirects |
category | Page category |
title | Page title |
device | Device type (MOBILE or DESKTOP) |
user_agent | Browser user agent |
origin | Scan origin (USER or API) |
ip | IP address |
org | Organization |
isp | Internet service provider |
asn | Autonomous system number (ASN) |
city | City |
country_code | Country code |
favicon | Favicon hash |
screenshot | Screenshot hash |
serial_number | Certificate serial number |
issuer | Certificate issuer |
subject | Certificate subject |
malicious | Flagged as malicious (1) or not (0) |
technology | Technology used by the website |
cookie_name | Cookie name |
cookie_value | Cookie value |
Operators
| Operator | Meaning |
|---|---|
= | Equal to |
!= | Not equal to |
LIKE | Contains |
!LIKE | Does not contain |
Combining conditions
You can combine several conditions with AND:
title LIKE PayPal AND domain !LIKE paypalExamples
- Domains containing “google”:
domain LIKE google - Pages with “PayPal” in the title hosted on a domain that doesn’t contain “paypal” — a classic phishing pattern:
title LIKE PayPal AND domain !LIKE paypal - Pages flagged as malicious:
malicious = 1 - Pages with a specific favicon:
favicon LIKE d40750994fe739d8
The favicon and screenshot hashes are especially useful for pivoting: once you find a phishing page, searching for its favicon hash often leads you to other pages built with the same kit.
Leave a Reply