Fake Malicious Websites for Reputation Testing

TL;DR

Yes, several websites exist specifically to test your cyber security tools and web reputation services without using actual malware. These sites mimic malicious behaviour but are harmless. This guide details how to find and use them effectively.

How to Test Web Reputation Services with Safe Sites

1. Understand the Need: Web reputation services (like VirusTotal, Google Safe Browsing, etc.) rely on identifying known bad websites. You need a way to *safely* confirm they’re working correctly and flagging threats as expected. Using real malicious sites is dangerous.
2. EICAR Test File – A Starting Point: The EICAR standard test file (https://www.eicar.org/standard-malware-sample) isn’t a website, but it’s good to know. It’s a harmless text string that antivirus software identifies as malware. It confirms your *endpoint* security is functioning.
3. Fake Malicious Website Resources: Here are some useful sites:
   • Malware Bazaar (abuse.ch): https://malwarebazaar.abuse.ch/ – Offers a large collection of malware samples and associated information, including URLs that *were* malicious but are often now taken down or sandboxed. Use with caution; some links may be historical.
   • URLhaus: https://urlhaus.abuse.ch/ – A collaborative project tracking malware distribution URLs. Similar caveats as Malware Bazaar apply.
   • Cuckoo Sandbox (if you have the setup): https://cuckoosandbox.org/ – Allows you to submit URLs and files for dynamic analysis in a safe, isolated environment. Requires technical expertise to set up.
   • Reverb (if you have the setup): https://reverb.externaldiode.com/ – Another sandbox solution similar to Cuckoo Sandbox.
   • Hybrid Analysis: https://www.hybrid-analysis.com/ – Provides static and dynamic analysis reports for submitted files and URLs.
4. Testing Procedure – VirusTotal Example:
   1. Find a URL: From one of the resources above (e.g., Malware Bazaar), locate a URL flagged as malicious, but ideally one that’s been reported recently and is still active.
   2. Submit to VirusTotal: Go to https://www.virustotal.com/ and paste the URL into the search bar.
   3. Check Results: VirusTotal will scan the URL with multiple antivirus engines and reputation services. Verify that a significant number of engines flag it as malicious.
   4. Repeat: Test several URLs to ensure consistent results.
5. Testing Procedure – Google Safe Browsing Example:
   1. Use the Transparency Report Tool: Go to https://transparencyreport.google.com/safe-browsing/search.
   2. Enter the URL: Type or paste the suspected malicious website address into the search box.
   3. Review Status: Google Safe Browsing will tell you if the site is currently listed as unsafe, safe, or has no status (meaning it hasn’t been evaluated).
6. Important Considerations:
   • Dynamic Nature of URLs: Malicious websites are often short-lived. A URL flagged today might be gone tomorrow.
   • False Positives/Negatives: Reputation services aren’t perfect. You may encounter false positives (legitimate sites incorrectly flagged) or, more concerningly, false negatives (malicious sites not detected).
   • Sandboxing is Best: If you have the resources, using a sandbox environment like Cuckoo Sandbox provides the most controlled and accurate testing.
   • Don’t Click Directly: Always copy and paste URLs into reputation services. Avoid clicking links directly from potentially malicious sources.
7. Command Line Tools (for advanced users): You can automate some checks using tools like curl to fetch the website content and then pipe it through a virus scanner.

   curl -s  | clamscan -

   (Requires ClamAV antivirus installed.)