# Phishing sandbox comparison: source notes

Case observations are from 27th October 2026. Feature and price references were
checked again on 28th October for the merged article. This is a dated research
record written by Sandfish, not a live status page or a detection benchmark.

## Selection and method

We selected three URLs from the 20 latest public Sandfish analyses returned by
`GET /api/analyses?limit=20&verdict=malicious` at about 15:43 UTC. We chose one
Meta appeal lure, one Xfinity login lure, and one Banco Pichincha flow. This is
a purposive sample of Sandfish-positive cases. `https://example.com/` was added
as a legitimate control. It is a basic page-load control, not a test of legitimate
login forms or an estimate of false-positive rates.

We submitted all four URLs to the regular urlscan Scan API and Sandfish's URL
submission API. Each pair used the same URL and explicit public visibility.
We sent each URL once per service. No submission failed. All eight resulting
analyses reached a terminal result. We also read each URL's existing VirusTotal
URL object. All four lookups returned HTTP 200; we did not request VT reanalysis.

The Sandfish code inspected locally and deployed at the start of the check was
`8d75af0c2aa1765d4c84f601a74029cf17dcd700`. Sandfish used engine `0.4.0`,
ruleset `web-v1:d76225786a93f5d1`, and score policy `v12`.

## Environments and limits

- Sandfish used the `pixel_7` profile, a 412 × 839 viewport, and a mobile
  Firefox 152 user agent. Its browser implementation used Camoufox. The route
  was `direct`; the reported egress verification status was `unverified`.
- urlscan received only the URL and public visibility. We did not select a
  country, user agent, or timeout. The inspected Xfinity and Pichincha requests
  used desktop Chrome 156 on Linux. The Pichincha screenshot was 1600 × 1200 pixels.
- The existing URLscan credential supplied Pro access. The test used the
  regular Scan API, not Quick Scanning or Live Browsing. Sandfish used its
  operator account. These observations do not measure free-tier capacity.
- VirusTotal used the configured account's URL-object read endpoint. We do not
  infer the account's full licensed entitlements from the returned fields.
- Browser engines, devices, egress, timing, and interaction budgets were not
  matched. Results do not isolate the cause of a difference between captures.
- Sites can serve different content, and reports can change after rescoring or
  reanalysis. Times and retained evaluation IDs define the observations below.
- We did not measure speed, detection accuracy, false positives, complete attack
  coverage, or paid interactive features. We ran no ANY.RUN, Cloudflare, Hybrid
  Analysis, or Joe Sandbox submissions.

## Public records

All timestamps in the following tables are UTC on 27th October 2026.

| Input | Submitted URL, defanged except control | Sandfish | urlscan |
|---|---|---|---|
| Meta appeal | `hxxps://bhig-to3t5-hn4a0x-vk6tt-uc2ntf.pages[.]dev/` | [Analysis](https://sandfi.sh/analyses/f1cf003f-3db8-4a87-acf5-e22a5b7dc197) | [Scan](https://urlscan.io/result/01a17e09-8697-763b-84c3-3ba7110ad9cf/) |
| Xfinity login | `hxxps://xfinityhelplogin.weebly[.]com/` | [Analysis](https://sandfi.sh/analyses/aafd50b7-d808-4c0d-bf6e-fbbba30cf1fa) | [Scan](https://urlscan.io/result/01a17e09-8d06-7619-952b-7fa7422121bd/) |
| Pichincha flow | `hxxps://whitliongecuadorera--ecuadorsurgee.replit[.]app/` | [Analysis](https://sandfi.sh/analyses/0fd36233-e586-4c5b-a9b5-2ccbcfbfbfee) | [Scan](https://urlscan.io/result/01a17e09-9148-7593-86cb-eb92f93090ff/) |
| Control | `https://example.com/` | [Analysis](https://sandfi.sh/analyses/97e7295c-4271-4c49-8a6a-56e2740422f6) | [Scan](https://urlscan.io/result/01a17e09-9465-72f0-b0ac-3fc72d2f51e5/) |

| Input | Pair accepted by | Sandfish capture start–finish | urlscan task time | Reports retrieved |
|---|---|---|---|---|
| Meta appeal | 15:45:16.925 | 15:45:17–15:46:20 | 15:45:51.893 | 15:47:03 |
| Xfinity login | 15:45:18.121 | 15:45:19–15:46:01 | 15:45:28.275 | 15:47:16 |
| Pichincha flow | 15:45:19.064 | 15:45:20–15:46:16 | 15:45:26.884 | 15:47:18 |
| Control | 15:45:19.868 | 15:45:21–15:45:32 | 15:45:25.881 | 15:47:19 |

Sandfish and urlscan task times have different meanings. This table is not a
latency comparison. The submission script sent each urlscan request immediately
before its corresponding Sandfish request and logged the pair after acceptance.

## Retained result observations

| Input | Sandfish evaluation ID | Verdict / completeness | Score | urlscan overall malicious |
|---|---|---|---|---|
| Meta appeal | `60ef46d2-0c85-4415-be13-02d0d935e8b5` | Malicious / partial | 95 | true |
| Xfinity login | `3d6aef8d-a47a-48e2-b7e4-396dd7c376db` | Malicious / complete | 95 | true |
| Pichincha flow | `5243092b-40da-45a6-9132-e0da3ff4186e` | Malicious / partial | 100 | true |
| Control | `84d7144a-3dde-4bec-be8a-436b9c64771b` | Benign / complete | 0 | false |

All four Sandfish evaluations were generation 2. All captures had WACZ archives.
The Meta reasons were `content_not_observed_before_suspected_exit` and
`interaction_stalled`. The Pichincha reason was `interaction_stalled`.

The Meta capture recorded the provider warning, a brief appeal-page snapshot,
and a redirect to Facebook. Its R049 request went to Facebook after the redirect.
Do not describe it as observed credential collection by the appeal page.

The Xfinity record links R049 version 17 to request
`d1432b90-73b5-48e6-987b-5007df98a942` and the preceding form snapshots. That
request is a POST to the Weebly-hosted `/ajax/apps/formSubmitAjax.php` path, with
an HTTP 200 response and a retained 965-byte multipart body. The body endpoint
reported `truncated: false`. The pre-interaction snapshot was
`af4b78c5-34c8-4c93-bcf1-8eeb0a2058b7` at 15:45:27 UTC.

The paired urlscan Xfinity report had three POST requests, all under the
site's `/cdn-cgi/challenge-platform/` path. Its recorded request hosts were
the submitted Weebly hostname and `challenges.cloudflare.com`. We did not
equate its POST count with credential submission.

The Pichincha record links R049 version 17 to request
`6b61b8d9-e05d-476f-a32e-7ee408de3474`. It is a POST to Discord's webhook
service with an HTTP 204 response and a retained 159-byte JSON body. The body
endpoint reported `truncated: false`. Its preceding credential-page snapshot was
`0b5fe117-cc70-48cc-aeef-c53c8ea6d2a0` at 15:45:41 UTC. Subsequent snapshots
show `index3.html` and `index4.html`. The latter asks for a code. Request data
and collector credentials are omitted from this note.

These request observations support the recorded submission workflow. They do
not prove that an attacker read the data, that a bank sent a code, or that every
stage completed. R049's synthetic-value interpretation comes from the linked
rule finding; this note does not publish the input values.

## VirusTotal URL objects

| Input / report | Read time | Last analysis time | Malicious | Suspicious | Undetected | Harmless | Timeout |
|---|---|---|---|---|---|---|---|
| [Meta appeal](https://www.virustotal.com/gui/url/fe1a2ee342f6a6c55735101bb1bd2b0872326595426dd895ada541116a15d976) | 15:45:20 | 02:05:09 | 5 | 0 | 34 | 54 | 0 |
| [Xfinity login](https://www.virustotal.com/gui/url/700f6232fe1176c77e671c203c9f713a5ea20de11cc51e5ad71c1a3408614359) | 15:45:46 | 07:39:47 | 22 | 1 | 25 | 46 | 0 |
| [Pichincha flow](https://www.virustotal.com/gui/url/f21e841a6d9fbaa4cad3a14deebd39fdf9fb84f6e18a93ef9f4dab62d6e15e2e) | 15:46:11 | 11:40:28 | 21 | 2 | 28 | 43 | 0 |
| [Control](https://www.virustotal.com/gui/url/0f115db062b7c0dd030b16878c99dea5c354b49dc37b38eb8846179c7783e9d7) | 15:46:37 | 15:17:41 | 0 | 0 | 31 | 62 | 0 |

The counts are observations from stored URL reports, not votes cast during our
browser runs. `Undetected` means no engine opinion, not harmless. The returned
objects also contained URL metadata. We did not test all premium relationships,
download features, file sandboxes, or the full VirusTotal interface.

## Figure provenance

The screenshots appear in the [merged comparison](https://sandfi.sh/blog/phishing-sandboxes-compared#real-cases-what-the-extra-evidence-changes).
The [Xfinity sequence diagram](https://sandfi.sh/blog/sandbox-comparisons/xfinity-request-sequence.svg)
remains available as supporting evidence from the former VirusTotal article.

| Published image | Source | Transformation |
|---|---|---|
| `pichincha-urlscan.webp` | Screenshot from urlscan task `01a17e09-9148-7593-86cb-eb92f93090ff`, task time 15:45:26.884 | Crop x=590, y=0, width=420, height=839 from the 1600 × 1200 image; encode as WebP |
| `pichincha-code.webp` | Sandfish snapshot `016a0972-2e38-428d-9b04-d538a5d6dc66`, `document_ready` at 15:45:57 UTC | Preserve the 412 × 839 frame; encode as WebP |
| `xfinity-request-sequence.svg` | Sandfish analysis `aafd50b7-d808-4c0d-bf6e-fbbba30cf1fa`; pre-interaction snapshot `af4b78c5-34c8-4c93-bcf1-8eeb0a2058b7`; POST `d1432b90-73b5-48e6-987b-5007df98a942`; post-interaction snapshot `0f71a5b6-6620-40c4-9056-ede16c975a45` | Diagram drawn on 28th October from the recorded sequence. Three steps show the Weebly-hosted form, its same-host submission with HTTP 200, and the later Xfinity navigation. The line orders observations; it does not represent server-side forwarding. |

Both images show fields before entry. No masking was needed. The code-field
dots are the page's empty-field display. The two screenshots show different
stages and browser environments; their pixels do not prove transmission.

The diagram's last step uses the post-interaction snapshot at 15:45:39 UTC on
27th October. It records an Xfinity savings-calculator page after the submission.
The diagram omits form values and makes no claim about who received or retained
them beyond the recorded browser exchange.

Diagram SHA-256:
`df12c060d3727cd266799876bbff95539b2e6d2a1342ad9d0fc64ea2d1a73411`.

| Image | Original SHA-256 | Published WebP SHA-256 |
|---|---|---|
| urlscan form | `4e03923286d6272ad97d57362adb90e05330b0fddc096ffe3b2704b744653566` | `b6cffed69c557651e1c04a4e98a777cb712d03cc89c7b226c2db902b8d2dc5fe` |
| Sandfish code prompt | `fc811f6a89d8de5197ea3b4eb4d64a7862896e793a1296ba9bccbd8d1032c2ee` | `05876d3aa44122db1c317ec8ec983115e6eb5a17d172a2720b0e3198edddfb5f` |

## Vendor documentation checked

All sources below were read on 27th October 2026. Vendor descriptions are not
independent measurements of performance or detection accuracy.

- urlscan: [FAQ](https://docs.urlscan.io/pages/faq/), [Pro](https://docs.urlscan.io/pages/urlscan-pro/), [Live Scanning](https://docs.urlscan.io/pages/livescanning/), and [brand detection](https://docs.urlscan.io/pages/brand-detection/).
- VirusTotal: [URL object](https://docs.virustotal.com/reference/url-object) and [Public vs Premium API](https://docs.virustotal.com/reference/public-vs-premium-api).
- ANY.RUN: [plans](https://any.run/plans/) and [Automated Interactivity Stage 2](https://any.run/cybersecurity-blog/automated-interactivity-stage-two/). The latter supplies a vendor demonstration, not our own reproduced result.
- Cloudflare: [URL Scanner guide](https://developers.cloudflare.com/radar/investigate/url-scanner/).
- CrowdStrike: [Hybrid Analysis upgrade](https://go.crowdstrike.com/HybridAnalysisRequest.html) and [Sandbox Scryer](https://www.crowdstrike.com/en-us/blog/sandbox-scryer-free-threat-hunting-tool/). The Hybrid Analysis FAQ returned no readable content through the research client. We did not infer capabilities from that access failure.
- Joe Security: [Cloud](https://www.joesecurity.org/joe-sandbox-cloud) and [technology](https://www.joesecurity.org/joe-sandbox-technology). The Cloud page's Basic quota differed between its summary and detailed table. The article therefore omits an exact allowance.

## Feature and price check, 28th October 2026

The merged article retains the case dates and observations above. We ran no new
captures. Local source and the observed deployed revision were
`99f47addeb3555df8956406ef9ccca1735ab8740`. The fetched remote was `fe3e25f`; its
changes concern Telegram collection, not the compared account or capture features.

These primary sources were read on 28th October. Prices are USD. Rows preserve
the advertised offer, not a purchased subscription or an independent capacity test.

| Source | Retained observation |
|---|---|
| [Sandfish plan catalog](https://sandfi.sh/api/account/usage/plans) | Free: $0/month, 10 submissions/day, 1 active operation, 1 API key. Starter: $50/month, 50/day, 2 active, 3 keys. Pro: $100/month, 150/day, 4 active, 10 keys. Team: $500/month, 1,000/day, 10 active, 50 keys. The response matched `sandfish/plans.py`. |
| [Sandfish access](https://sandfi.sh/docs#authentication) | API and browser usage share the allowance. Private submissions require a paid plan and private records require their owner. Guest URL/EML allowance is five per public IP per UTC day. |
| [urlscan pricing](https://urlscan.io/pricing/) | Free daily quotas: 5,000 public, 1,000 unlisted, 50 private scans. Automate: $5,000/year, API-only. Professional: $1,250/month or $12,500/year, including 10 Pro seats. Prices exclude applicable taxes. |
| [urlscan Live Scanning](https://docs.urlscan.io/pages/livescanning/) and [FAQ](https://docs.urlscan.io/pages/faq/) | Pro offers mouse/keyboard interaction. Regular scans use Chrome. Stored responses include HTML, JavaScript, and text. The FAQ states that downloaded executable behavior is not analyzed. |
| [ANY.RUN plans](https://any.run/plans/) and [automation](https://any.run/cybersecurity-blog/automated-interactivity-stage-two/) | Community is free with a personal license and 60-second sessions. Hunter and Enterprise Suite show individual quotes, billed yearly. Automation is documented for Hunter and Enterprise Suite. Enterprise Suite lists 1,500+ API tasks/month. |
| [VirusTotal API terms](https://docs.virustotal.com/reference/public-vs-premium-api) | Public API: 500 requests/day and 4/minute. Excludes commercial products/services and business workflows that do not contribute new files. Premium requires contact; no fixed price shown. |
| [Cloudflare limits](https://developers.cloudflare.com/security-center/investigate/scan-limits/) and [scanner guide](https://developers.cloudflare.com/radar/investigate/url-scanner/) | Free/Radar: 5,000 public scans/month, no unlisted scans, search history of the last 50 scans. Enterprise permits location selection. Successful scans have 12-month retention. Higher-tier allowances are published without a standalone scanner price. |
| [CrowdStrike upgrade](https://go.crowdstrike.com/HybridAnalysisRequest.html) | The page states 30 Hybrid Analysis file uploads/month and Falcon Sandbox licenses starting at 250/month. Commercial private analysis is documented; no fixed price shown. The earlier unreadable FAQ did not prevent verification of this separate source. |
| [Joe Cloud](https://www.joesecurity.org/joe-sandbox-cloud) and [technology](https://www.joesecurity.org/joe-sandbox-technology) | Basic is free and public with limited API access. Pro and Enterprise require quotes; Pro starts with five users. The page still conflicts on Basic volume: 10/month in its summary, 15/month in its table. Phishing automation, live control, program execution, and paid Mail Monitor are documented. |

The feature table compares documented capabilities, not measured parity. The
original paired scans tested regular urlscan capture, not Pro Live Browsing.
ANY.RUN's email-to-PDF-to-QR sequence remains a vendor demonstration. Joe's
automation is documented, but neither product received a submission in this study.