Building a threat intelligence feed using the Twitter API and a bit of code

Re:Building a threat intelligence feed using the Twitter API... by rashkov on Saturday May 28, 2022 @09:08PM (#31545282)

Could be cool to have a honeypot that automatically visits those links via puppeteer or some other browser automation.

[ Parent | on HN ]

Re:Building a threat intelligence feed using the Twitter API... by heipei on Sunday May 29, 2022 @05:32AM (#31547776)

Check out urlscan.io which lets you scan URLs very conveniently and returns a report, including phishing and brand impersonation verdicts.

Disclaimer: I’m the founder ;)

[ Parent | on HN ]

Re:Building a threat intelligence feed using the Twitter API... by Robbedoes on Sunday May 29, 2022 @09:25AM (#31548956)

Am a fan of your work! Would it be useful if I throw these domains directly to URLScan? For retrieving the results I'll probably have to setup a proper DB and a workflow around parsing the Twitter content. Now, it's just a simple script.

[ Parent | on HN ]

Re:Building a threat intelligence feed using the Twitter API... by heipei on Monday May 30, 2022 @04:05PM (#31563128)

Sure, I don't see why not, the worst thing that could happen is that the domain doesn't resolve or the webserver doesn't respond, but at least there will be a record of the domain having been scanned! Thanks for the kind words ;)

[ Parent | on HN ]

Re:Building a threat intelligence feed using the Twitter API... by Robbedoes on Saturday May 28, 2022 @09:34PM (#31545428)

Plan in the future is to visit the links, download malware and upload it to VirusTotal, Malwarebazaar, etc.

[ Parent | on HN ]