How to Investigate Suspicious URLs Like a SOC Analyst: Top Tools and Steps Explained

Key takeaways

• Defang every reported link, for example hxxps and [.] in the domain, before pasting it into chat or tickets.
• Never open the URL on your work machine; use urlscan.io, ANY.RUN or an isolated analysis VM with no company access.
• Check domain age through WHOIS and DNS, then find who else clicked it, because containment matters as much as the verdict.

Most phishing and many malware infections start with one link. This guide gives you a repeatable workflow, the free tools analysts actually use, the indicators that matter, and a report template you can copy into your ticketing system.

Before you start: handle the URL safely

Treat every reported link as live until proven otherwise. Three habits prevent most analyst mistakes:

• Defang it before pasting it anywhere: hxxps://login-alert[.]example/verify. This stops chat tools and email from turning it into a clickable link.
• Don't browse it from your work machine. Use an online scanner, a sandbox or an isolated analysis VM with no access to company systems.
• Watch what you share. Phishing links often contain the victim's email address or a session token. Public scans on urlscan.io and submissions to VirusTotal can be seen by others, so remove personal data or use a private or unlisted scan.

The 7-step URL investigation workflow

1. Triage the report. Note where the URL came from (email, SMS, chat, proxy alert), who reported it and when. For email, keep the full message with headers.
2. Read the URL itself. Break it into scheme, subdomain, registered domain, path and parameters. Many fakes are obvious at this stage, for example microsoft.com.account-check[.]example, where the real domain is the part just before the top-level domain.
3. Check reputation. Look the URL and domain up in several sources. One clean result proves little, because new phishing sites are often unknown for hours.
4. Check domain and infrastructure. WHOIS (registration date and registrar), DNS records, hosting IP and its reputation, and the TLS certificate.
5. Observe behaviour safely. Run it through a URL scanner for redirects, page content and contacted domains. If it downloads a file, analyse that in a sandbox.
6. Scope the impact. Search email, proxy, DNS and EDR logs: who received the link, who clicked, and did anyone enter credentials or run a download?
7. Contain, report and close. Block the domain, remove the emails, reset any exposed credentials, record your indicators of compromise (IOCs) and write the verdict.

Step 6 is the one beginners skip. Proving a link is malicious is only half the job; the incident is about the people who clicked it.

Tools SOC analysts use to check URLs

For a wider view of the SOC toolkit, see our guide to essential tools every SOC analyst should master.

Checking a URL from the command line

Inside an isolated analysis VM, a few commands show where a link leads without rendering the page:

# Follow redirects and show only headers (no page rendering)
curl -sIL --max-redirs 10 "https://login-alert.example/verify"

# Who registered the domain, and when
whois login-alert.example | grep -iE "creation|registrar"

# Where it points
dig +short login-alert.example A
dig +short login-alert.example MX

Some phishing kits show a harmless page to scripts and security scanners and only serve the fake login to real browsers from the target country. If curl shows nothing odd, that is not a clean verdict; check the scanner screenshot too.

Red flags that suggest a URL is malicious

A valid HTTPS padlock is not a sign of safety. Free certificates mean most phishing sites now use HTTPS too.

Worked example: a fake Microsoft 365 login

This example is illustrative and uses a reserved domain name.

1. Report: a user forwards an email saying "Your password expires today" with a link to hxxps://m365-login-alert[.]example/[email protected].
2. URL read: the registered domain is m365-login-alert[.]example, not microsoft.com, and the user's email is in the query string.
3. Reputation: a few vendors flag it as phishing; Safe Browsing does not list it yet.
4. Infrastructure: WHOIS shows the domain was created two days ago; crt.sh shows a certificate issued the same day.
5. Behaviour: the urlscan.io screenshot shows a copy of the Microsoft sign-in page that posts the password to a third-party domain.
6. Scope: the mail gateway shows 38 recipients; proxy logs show 4 clicks; sign-in logs show one user signed in from an unfamiliar location an hour later.
7. Action: block the domain and posting endpoint, purge the email, reset that user's password, revoke active sessions, check for new mailbox rules, and notify the other clickers.

URL investigation report template

In India, phishing attacks are among the incident types that CERT-In's April 2022 directions require organisations to report within six hours of noticing them. Check with your compliance team that your playbook covers this.

Common mistakes to avoid

• Calling a URL safe because VirusTotal shows zero detections.
• Pasting a link with a victim's email address into a public scanner.
• Clicking "just to check" on a work laptop.
• Stopping at the verdict without checking who clicked.
• Blocking only the first domain and missing the redirect target where credentials are actually sent.

Automating URL triage

High-volume SOCs automate the first four steps with a SOAR platform or a script that calls the VirusTotal and urlscan.io APIs, adds WHOIS age and posts a summary to the ticket. Analysts then spend their time on behaviour and scoping. Automate only once you can do the process by hand and know what a wrong automated verdict looks like.

Next step

Take a phishing email from your spam folder or a public phishing feed and run it through all seven steps in an isolated VM, filling in the report template as you go. If you are building toward an analyst role, our list of SOC analyst interview questions shows how URL triage comes up in interviews, and CompTIA CySA+ training covers this kind of analysis in a structured lab.

Related reading

• What are the best anti-phishing tools for SOC analysts to use in 2026?
• VirusTotal Explained | How to Scan Files and URLs for Malware Using 70+ Antivirus Engines
• NetScanTools Pro | Complete Network Investigation Tool for Cybersecurity, Port Scanning, and DNS Analysis