ANY.RUN Adds In-Browser Data Inspection to Reveal Phishing Redirects and DOM Changes

ANY.RUN today launched in-browser data inspection for its Interactive Sandbox, a capability that brings real browser-level visibility directly into URL analysis workflows and addresses longstanding blind spots in phishing investigations.

Modern URL phishing increasingly leverages dynamic pages, layered redirect chains, client-side scripts, iframes and credential-harvesting flows that static scanners and screenshot-based sandboxes routinely miss.

By executing suspected URLs in a full browser and capturing the runtime DOM, network requests, redirects and injected code, ANY.RUN unifies static and dynamic evidence into one fast, analyst-friendly view.

The new Browser Data tab surfaces the full execution tree from initial URL to final rendered page, highlighting redirect hops, iframe activations and the elements that trigger detections.

Analysts can inspect HTTP request and response details, rendered screenshots at different execution stages, and an HTML DOM Changes view that isolates code fragments added after load crucial for identifying obfuscated JavaScript and dynamically injected credential forms.

All collected indicators URLs, domains, IPs and content hashes are available for pivoting, hunting and detection engineering without leaving the sandbox interface.

Operationally, the feature reduces the manual stitching that has defined URL triage. Where teams previously combined URL scans, sandbox outputs, proxy captures and ad-hoc browser replays to reconstruct attack flows, ANY.RUN now presents that context within seconds.

This lowers time-to-verdict, reduces unnecessary escalations from Tier 1 to Tier 2, and delivers a complete evidence package for incident responders and detection engineers.

According to ANY.RUN, this new layer of URL phishing visibility provides a massive boost for the triage and response speed for SOC & MSSP teams

ANY.RUN Adds In-Browser Data Inspection

Technically, the value lies in capturing ephemeral runtime artifacts that static analysis misses: executed scripts, dynamically created forms, client-side redirection logic and intermediate page states hidden behind JavaScript-driven loads.

The DOM history feature is especially important for deobfuscation workflows analysts can compare initial page source to subsequent DOM mutations to reveal injected code paths and data-collection points.

Full HTTP request tracing reconstructs redirect chains and enables mapping of attacker infrastructure, while embedded threat intelligence and a YARA-generation workflow let teams convert page artifacts into huntable signatures.

The offering integrates with existing ANY.RUN capabilities interactive sandboxing, sandbox reports and threat-intelligence lookup so teams retain familiar workflows while gaining deeper browser telemetry.

That consolidation avoids the common fragmentation where evidence lives across screenshots, proxy logs, and SIEM entries.

By delivering an end-to-end browser-centric view, ANY.RUN helps security teams validate phishing behavior, extract actionable indicators, and craft network- and host-based detections informed by actual runtime behavior rather than static heuristics.

For organizations evaluating URL investigation tools, this release underscores an industry shift: effective phishing analysis now requires browser-level observability.

ANY.RUN’s publicly available pages detail the feature and show how to launch analyses; SOCs and MSSPs can try it via the Interactive Sandbox and review documentation on phishing detection steps, threat hunting, and sandbox features.

Links of interest include ANY.RUN’s product landing, the Browser Data examples in the Interactive Sandbox, MSSP pages and the threat-intelligence lookup that supports YARA searches.

As phishing techniques continue to evolve toward client-side complexity, in-browser data inspection provides a pragmatic, evidence-driven way to close visibility gaps and accelerate response turning fragmented URL forensics into one cohesive investigation with immediate operational benefits.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.