Handling URLs from suspicious email: extraction, defanging, and reputation checks

Extracting the real links

The visible text of a link and its href often differ, and gateways rewrite links through safe-link services. Parse the HTML part to collect every href, then decode any rewrite wrappers to recover the original URL.

python3 - <<'EOF'
import email, re, html
from urllib.parse import urlparse, parse_qs, unquote
m = email.message_from_file(open('sample.eml'))
for part in m.walk():
    if part.get_content_type() == 'text/html':
        body = part.get_payload(decode=True).decode(errors='replace')
        for href in re.findall(r'href=["\']([^"\']+)', body):
            href = html.unescape(href)
            qs = parse_qs(urlparse(href).query)
            print(unquote(qs['url'][0]) if 'url' in qs else href)
EOF

Defanging

Defanging makes a URL non-clickable in tickets and chat: replace http with hxxp and dots in the domain with [.]. Many tools, including CyberChef, have defang and refang operations. Always store indicators defanged in shared notes.

https://login.examp1e-hr.example/reset?id=42
hxxps://login[.]examp1e-hr[.]example/reset?id=42

Lab: assess three links without visiting them

From a training phishing sample, extract every link, unwrap any redirectors, and defang them. For each domain, check registration age with WHOIS or RDAP, certificate history on crt.sh, and reputation on URLhaus or VirusTotal. If you need to see the page, use a sandboxed URL scanner such as urlscan.io with private visibility, not your browser.

• Domain age: RDAP or WHOIS creation date
• Certificates: crt.sh first-seen date
• Reputation: URLhaus, VirusTotal
• Rendering: urlscan.io private scan

Signals that matter

Newly registered domains, lookalike spellings, free hosting or form services, and login pages for a brand on a domain that brand does not own are strong indicators. Clean reputation is weak evidence of safety, because new phishing sites are often unknown for their first hours.