WebIOC by ScaMatrix

WebIOC by ScaMatrix: local URL and IOC investigation. Capture redirects, headers, HTML, scripts, links, and IOCs. No cloud upload.

Turn a suspicious link into a structured investigation without uploading the page to the cloud. WebIOC by ScaMatrix is a local-first Chrome extension for security analysts, IT teams, and anyone triaging phishing, malware, or odd redirect behavior. Created by Mark Liapustin (clizSec) for the ScaMatrix security toolkit. Point WebIOC at a page you already suspect and it builds a clear record of what loaded, where it tried to send you, and which indicators are worth checking. WHAT YOU GET IN ONE CAPTURE • Redirect chain: HTTP redirects, meta refresh, JavaScript navigation, SPA history, and hop metadata • Page evidence: titles, request/response headers, view-source HTML, rendered DOM, favicons • IOC extraction: domains, URLs, IPs, emails, inline scripts, stylesheets, and linked assets • Hashes: MD5, SHA1, and SHA256 for source content and favicons where available • Collections: organize multiple cases, rename tabs, and switch investigations in the side panel WORKFLOW • Capture This Page: snapshot the current tab into your active collection • Open a URL: load a link in a new tab and record the full load path • Reload Page: refresh and recapture when you need a clean request trail • Export: JSON, Markdown, HTML, or IOC CSV for tickets, reports, or threat intel workflows • Quick intel links: jump from an IOC to common lookup destinations PRIVACY BY DESIGN WebIOC runs locally in your browser. Captured data stays on your machine in extension storage until you delete it. Capture runs only when you start it, not as background monitoring of everyday browsing. Nothing is sent to ScaMatrix or developer servers. Privacy policy: https://scamatrix.com/en/webioc/privacy WHO IT IS FOR • Security analysts reviewing phishing pages • IT and SOC staff validating suspicious links • Researchers documenting redirect and delivery chains • Anyone who wants structured URL evidence without a SaaS upload step Start with Capture This Page on a suspect tab, review the redirect chain in the side panel, then export when you are ready to share or archive findings. WebIOC is an investigation utility. Use it responsibly and only on content you are authorized to analyze.