---
name: urlquery-threat-research
description: Analyze suspicious URLs, reports, domains, IPs, hashes, phishing infrastructure, and web threat activity with the urlquery MCP server. Use when a request needs URL behavior, report evidence, infrastructure pivots, reputation, trends, or a defensible CTI assessment.
---

# urlquery Threat Research

Use the urlquery MCP server as the primary evidence source for web threat investigations.

## Investigation Method

1. Frame the question, relevant indicators, time window, and required outcome.
2. Observe captured behavior in representative reports before making campaign or infrastructure claims.
3. Correlate exact indicators and distinctive infrastructure facts across a bounded report population.
4. Assess what the evidence supports, alternative explanations, confidence, and collection gaps.
5. Preserve report IDs, hashes, queries, dates, and important tool arguments in the result.

## Evidence Strategy

- For an existing report, summarize it first and retrieve focused detections, HTTP activity, scripts, artifacts, technologies, screenshots, or resources only when needed.
- For one important HTTP transaction, preserve its original one-based index and request detailed metadata before opting into captured raw headers or request-data chunks.
- For a URL, check exact URL/FQDN reputation and search visible reports before expanding related infrastructure. For domains, IPs, hashes, Telegram tokens, and other unsupported reputation inputs, use report search and the applicable indicator or host pivots.
- When preparing a handoff with `list_report_indicators`, request explicit kinds; omitted kinds include exact threat-actor Telegram bot tokens.
- For change over time, use explicit complete periods and report the analyzed population.
- For host relationships, prefer distinctive certificates, cookie fingerprints, and corroborated interactions over common hosting or technology matches.
- Return to report-level behavior to validate candidates produced by pivots or graph searches.

## Safety and Interpretation

- Submit a new URL only with explicit authorization and an intentional visibility setting.
- Never place credentials, private tokens, personal data, or confidential internal names in submissions or metadata.
- Treat detections, reputation, tags, and relationships as observations, not automatic verdicts or attribution.
- Do not describe missing detections as proof that an indicator is benign.
- State when results are bounded, partial, visibility-dependent, or limited by the available time window.

## Response Structure

Return:

1. Executive summary
2. Direct observations and supporting report IDs
3. Correlated infrastructure and IOCs
4. Assessment with confidence
5. Gaps, alternative explanations, and recommended next pivots