Technical insights on web security, malware detection, certificate validation, and threat intelligence
ScanMalware Query Language (SMQL) is a powerful search syntax for querying our entire scan database. Combine 120+ filters across TLS certificates, JavaScript analysis, WHOIS data, malware detection, and more with boolean logic and comparison operators.
ScanMalware introduces two new behavioral fingerprinting algorithms that cluster JavaScript by runtime behavior patterns rather than exact code matching. Stable signatures bucket API usage into categories for deterministic grouping, while behavior vectors enable continuous similarity scoring across scans.
ScanMalware adds 16 new YARA detection rules for Coruna (CryptoWaters), the nation-state-grade iOS exploit kit targeting Safari/WebKit on iOS 13-17.2.1. Our rules detect both specific IOCs and generic browser exploitation techniques including in-browser Mach-O parsing, ARM64 gadget scanning, and NaN-boxing type confusion.
Deep technical analysis of ShinyHunters' sophisticated real-time phishing kit used for SSO credential theft and MFA bypass. Detailed breakdown of the attack infrastructure, JavaScript malware, and MFA bypass mechanisms used against healthcare and fintech companies.
We're excited to announce the official ScanMalware CLI tool - a Rust-based command-line interface that brings the full power of ScanMalware's security analysis directly to your terminal for automation, batch processing, and DevSecOps workflows.
Learn how we added Certificate Authority Authorization (CAA) DNS record validation to our TLS analyzer, including a robust 6-tier DNS fallback strategy to ensure reliable lookups.
Certificate Transparency (CT) logs are now required by browsers for all publicly trusted certificates. Learn how we validate CT compliance and what it means for web security.
Modern browsers enforce strict limits on TLS certificate validity periods. Learn about the 398-day rule, why it exists, and how we detect certificates that violate these industry standards.