URL Domain

Overview#

The URL domain provides URL profile management for tracking and analyzing URLs as part of investigations. URL profiles capture the URL structure, associated domain information, WHOIS registration data, DNS records, and SSL certificate details to build comprehensive intelligence about web resources of interest.

Key Features#

• URL Profile Management - Create and maintain detailed profiles for URLs under investigation, capturing the full URL structure including scheme, domain, and path components.

• WHOIS Integration - Retrieve and store domain registration information including registrar, registrant, registration dates, name servers, and domain status for investigative context.

• DNS Analysis - Record DNS information including A, AAAA, MX, NS, TXT, and CNAME records to understand the hosting infrastructure and mail configuration behind tracked URLs.

• SSL Certificate Tracking - Capture SSL certificate details including issuer, subject, validity dates, and fingerprints to verify site authenticity and track certificate changes.

• Status Monitoring - Track whether URLs are active or inactive with HTTP response code recording to monitor the operational status of web resources under investigation.

• Investigation Linking - Associate URL profiles with active investigations for organized case management and cross-reference analysis.

• Threat Assessment - Assign threat levels and assessments to URL profiles to communicate the risk associated with specific web resources.

Use Cases#

• Phishing Investigation - Profile suspected phishing URLs with full infrastructure analysis including WHOIS, DNS, and SSL data to identify threat actors and hosting infrastructure.

• Infrastructure Mapping - Map the web infrastructure of investigation targets by profiling their URLs, domains, and hosting relationships.

• Threat Indicator Tracking - Maintain profiles for malicious URLs identified during threat intelligence operations, including hosting infrastructure and registration details.

• Digital Evidence - Document web-based evidence with comprehensive URL profiles that capture infrastructure state at the time of investigation.

Integration#

The URL domain connects with cyber investigation capabilities across the platform:

• Domain Profiles - URL profiles link to parent domain records
• Profile Management - URL profiles extend the base profile system
• Threat Intelligence - URL indicators enrich threat analysis
• Investigation Management - URL profiles associate with active investigations

Last Reviewed: 2026-02-05