Methods and coverage
How each category produces its evidence.
AMY keeps every result attributable to its source. Missing records, unavailable services, quota limits, and positive detections remain distinct. The methods below describe exactly what the application requests and what those observations can establish.
01 · IOC INTELLIGENCEProvider record correlation
Input is normalized by type: IPv4/IPv6, IDN-aware domain, HTTP(S) URL, or MD5/SHA-1/SHA-256 hash. Defanged indicators are normalized before lookup.
VirusTotalAbuseIPDBThreatFoxMalwareBazaarURLhausurlscan.io
- IPQueries existing reputation and intelligence records. Results can include engine detections, abuse confidence, recent reports, malware associations, and archived observations.
- DomainQueries domain records directly. For AbuseIPDB only, AMY extracts the registrable domain, resolves public A and AAAA records, and reports each resolved IP separately.
- URLSearches encoded existing-report identifiers and exact URL records. IOC lookup does not request a new provider scan or open the URL in the user’s browser.
- HashUses exact hash searches. MalwareBazaar receives a form-encoded hash query; supporting providers return only records available to the configured account.
- OutputProvider status, native metric, evidence, timestamps, infrastructure fields, source link, and explicitly reported relationships.
Technical limit: scores from different providers are not mathematically compatible and are never combined into one probability.
02 · CVE CHECKERMulti-source vulnerability correlation
A CVE identifier is validated and used to retrieve passive vulnerability intelligence. No network connection is made to the potentially affected asset.
NVDCISA KEVFIRST EPSSVendor references
- NVDProvides the description, publication and modification dates, CVSS score/vector, CWE weaknesses, affected CPE product records, and references.
- CISA KEVChecks whether the CVE appears in the Known Exploited Vulnerabilities catalog, including required action, catalog date, due date, and reported ransomware use.
- FIRST EPSSReturns the modelled probability of exploitation during the next 30 days and its percentile among scored vulnerabilities.
- PriorityAMY highlights known exploitation, or combines very high CVSS severity with material EPSS likelihood, while keeping the underlying values visible.
- OutputSeverity evidence, exploitation context, affected products, analyst action, and direct source references.
Technical limit: a CVE record does not prove exposure. Product, version, reachability, and compensating controls must be verified against the asset.
03 · WEB ASSESSMENTBounded live response inspection
Only public HTTP(S) targets are accepted. Embedded credentials, local names, private, loopback, link-local, reserved, multicast, carrier-grade NAT, and cloud-metadata addresses are rejected after DNS validation.
HTTP HEAD/GETTLS handshakesHTML and scriptsOSV
- HeadersSends a bounded HEAD or GET request and evaluates returned controls including CSP, HSTS, framing, MIME sniffing, referrer policy, and permissions policy. Credential-bearing custom headers are blocked.
- TLSPerforms direct TLS handshakes across versions 1.0, 1.1, 1.2, and 1.3. Auto mode checks ports 443, 465, 636, 853, 989, 990, 992, 993, 995, 8443, and 9443; custom mode checks one selected port.
- VersionInspects response headers, HTML generator metadata, script URLs, and bounded JavaScript responses. Redirect destinations and discovered scripts are revalidated before each request.
- CVEsOnly explicitly verified package versions are correlated with OSV advisories. Product signatures without a version remain unversioned.
- OutputObserved headers, protection status, TLS protocols/ciphers, certificate fields, disclosed products and versions, evidence paths, and related advisory links.
Technical limit: this is not a penetration test. It does not authenticate, crawl broadly, exploit findings, or prove that a detected technology is vulnerable.
04 · PUBLIC SANDBOXHosted URL detonation workflow
An approved public URL is submitted through AMY’s server to Recorded Future Triage. Provider credentials remain server-side and are never sent to the visitor’s browser.
Recorded Future TriageURL submission120-second taskHosted report
- ValidateThe URL passes the same outbound-address policy used by live checks, and the user must acknowledge public disclosure before submission is enabled.
- SubmitAMY creates a URL sample with Internet networking and a 120-second analysis timeout through Triage’s authenticated API.
- TrackThe browser receives a signed, time-limited ownership token and polls task status while the page is visible. The provider task identifier is validated before report retrieval.
- ReportWhen available, AMY displays provider status, score, behavioral signatures, related indicators, timestamps, and a link to the full hosted report.
- BoundaryAMY does not claim process, registry, file, network, or screenshot telemetry unless the provider response actually supplies that evidence.
Public and permanent: submitted URLs and analysis results may be visible to other users and cannot be deleted by a researcher account.
