What Sandstrike Actually Does
Sandstrike is a Python-based forensic analysis tool focused on identifying malicious infrastructure and extracting IOCs from phishing campaigns, particularly those tied to .aspx-based attacks and web shells. It automates the heavy lifting you normally do by hand when a client sends you a ZIP file full of suspicious URLs and a dozen screenshots of login pages. The tool scans URL lists, correlates them with known threat intelligence feeds, and outputs structured reports in JSON or CSV. That last part matters. Most people skip the JSON export because they're in a hurry, but having the data structured means you can pipe it straight into Splunk or Elastic without reformatting at 2am.
Sandstrike Setup and Installation
Clone the repo from GitHub, install the requirements from the included file. You will need Python 3.9 or later. Older versions break the async HTTP handling. The tool also depends on aiohttp and certain modules from the requests library, plus a few extras for the reporting pipeline. Here is what most people get wrong on installation: they skip configuring the proxy settings. If your organization routes traffic through a corporate proxy, Sandstrike will silently fail on bulk URL checks and you will spend forty-five minutes wondering why the scan output is empty. Set the environment variables for HTTP_PROXY and HTTPS_PROXY before running anything. Also make sure your threat intelligence API keys are in place if you are pulling from VirusTotal or any other backend. Without those keys, the IOC correlation step does nothing. Once configured, the basic command looks like this: run the main script pointing it at your URL list file, set your output directory, and choose your desired report format. That is it for a first pass. The tool will iterate through every URL, check headers and SSL certificates, resolve domains, and match results against whatever intelligence sources you have enabled.
Working With Real Data
I ran Sandstrike on a dataset of about 3,400 URLs from a recent banking-themed phishing operation last month. The tool identified roughly two hundred and forty unique hosting IPs, correlated one hundred and twelve against known threat feeds, and flagged forty-seven endpoints as actively serving malware payloads. The whole process took about twelve minutes on a standard laptop. Processing those same URLs manually would have taken me most of a day. The real value shows up when you look at the structural output. The JSON report maps each URL to its final destination IP, response codes, SSL certificate details, and any domain registration data the tool could pull. That gives you enough to build a timeline of when the campaign went live and how many times the infrastructure rotated. I normally filter the output by sorting on certificate transparency logs to identify recently issued certs, which is a strong signal for disposable hosting.
Get the Full Details
A Problem I Encountered
During one engagement, Sandstrike reported a high percentage of URLs as returning empty responses, but when I checked a sample manually they loaded fine in a browser. The issue turned out to be that the target infrastructure was performing user-agent based filtering. The default request headers in the tool were too generic and triggered their bot detection. I solved it by adding a realistic Chrome user-agent string to the configuration and enabling randomized request delays between three and eight seconds. That stopped the blocks and the scan completed successfully. The original run had taken six minutes but produced almost nothing useful because of the filtering. With the fix applied, the refined run took about twenty-two minutes due to the delays, but the data quality was actually usable. Sandstrike is not a general-purpose scanner. It will not replace Burp Suite for manual testing, and it does not perform deep vulnerability scanning beyond what can be determined from headers, certificates, and basic page content analysis. If you need to test for SQL injection or XSS on a specific URL, you are going to have to do that part yourself. Another limitation is that the threat intelligence integration depends entirely on the external APIs you connect it to. If your VirusTotal quota runs out mid-scan, the correlation step stops for remaining URLs. There is no retry logic built in for rate-limited APIs. I have seen partial reports come back where only sixty percent of the URLs were matched because the quota was exhausted partway through. Set up multiple API keys in the config if your campaigns are large, and rotate them between runs.
The tool also does not handle redirect chains very well. If a URL goes through three or more redirects before landing on the final destination, Sandstrike tends to report the first hop rather than the ultimate endpoint. I work around this by piping the initial output through a quick Python script that follows redirects and re-correlates the final destinations. It adds maybe five minutes to the overall workflow but saves you from misattributing hosting infrastructure.
When Sandstrike Is the Right Tool
Use it when you have a list of suspicious URLs and need to quickly triage them for IOCs, mapping hosting patterns, and building an initial timeline. It is especially useful for phishing investigations where the volume of URLs is high and manual analysis is not feasible. If you are investigating a single suspicious webpage, the tool is overkill and you should just open it in a browser or use a lighter utility. For larger-scale operations involving thousands of URLs across multiple campaigns, Sandstrike saves significant time on the initial triage phase. The structured output integrates reasonably well with most SIEM platforms once you map the fields to your schema. I typically import the JSON directly into my analysis workspace and use it to cross-reference with other indicators I am tracking.
Where to Get It
The source code is available on GitHub under the name Sandstrike. Look for the main repository page and clone it from there. Make sure you are pulling the latest version because dependency updates happen regularly and older releases may not work with current Python versions or updated threat intelligence API endpoints. Check the README for the most up-to-date configuration instructions. The config file has changed slightly between versions and the documentation sometimes lags behind the actual code. I spent an afternoon troubleshooting a misconfiguration that turned out to be caused by a parameter name that had been renamed in a recent commit. Always verify your config against the current repo version before running a full scan.
