Question 1

How does the sandbox work?

Accepted Answer

The page and its scripts are fetched by our proxy, analyzed statically, then executed in an isolated iframe (opaque origin, no access to your session) with an instrumentation script: dynamic code (eval, atob), clipboard, generated files, WebSocket, geolocation, camera, browser fingerprinting, credential forms… Links, forms and windows are intercepted and never followed outside the proxy.

Question 2

How is the verdict calculated?

Accepted Answer

Each signature (static or observed at runtime) adds points according to its severity; signals common on legitimate sites (password field, Service Worker, browser fingerprinting…) are capped at 15 points in total. The scale is the API's: a legitimate login page stays clean, a brand-themed login page outside the brand's domains is malicious.

Question 3

How do I detect cloaking?

Accepted Answer

Enable Multi-UA mode: the same URL is loaded in parallel with five browsers (desktop and mobile) and Googlebot, each running the page with its own User-Agent. A final destination, HTTP status or credential form that differs by profile is flagged as cloaking.

Question 4

Which URLs can be analyzed?

Accepted Answer

Only public pages. Local domains, internal TLDs and private IP addresses are rejected, and the tool does not let you inject cookies or authentication headers.

Question 5

Which IOCs can I collect?

Accepted Answer

Emails, IP addresses, URLs and Base64 blobs found in the source code, the redirect chain, contacted domains and detected technologies. The full report can be exported as JSON for your TIP or incident ticket.

Question 6

Can I analyze URLs via API?

Accepted Answer

Yes. With a personal API key (sandbox:analyze scope, created from the portal), POST /v1/sandbox/analyze fetches the URL with up to six profiles (browsers, mobiles, Googlebot), follows redirects while refusing internal networks, statically analyzes the page and the site's scripts (phishing, exfiltration, ClickFix, HTML smuggling, evasion) and flags cloaking. No JavaScript is executed: to watch execution and get a screenshot, use the web tool. Documentation: forenshield.com/en/developers/api.

Suspicious URL Analyzer Online

Analysis Configuration

Multi User-Agent Analysis