Website malware detection

Behavioral malware detection for websites

Some website malware cannot be seen in the page source. It redirects only certain visitors, runs after the page has loaded, or appears only after a search click. ScanTitan combines content inspection with a bounded look at how the landing page and its scripts behave in an isolated browser, and compares visitor scenarios to find suspicious redirects, downloads and other signs of compromise.

  • Content and runtime inspection
  • Five visitor scenarios
  • Redirects and downloads

Start with a free account: one website and one included website security scan. Registering does not activate paid features.

Create free accountSee the visitor scenarios

Why static scanning misses selective malware

A scanner that downloads one copy of a page and reads its source sees only what the server chose to send that one time. Compromised websites are often built to avoid being noticed. They show a clean page to the owner and to crawlers, and attack other visitors.

  • Selective redirects send first-time visitors, mobile visitors or people arriving from a search result to another site.
  • Runtime behavior appears only after scripts run, such as an injected iframe, a forced redirect or a download prompt.
  • Different audiences get different content, so one clean view is not proof that every view is clean.

Behavioral malware detection adds the missing view: what the page does in a browser, and whether that changes with the visitor.

How behavioral malware detection works on a website scan

  1. Inspect the content. The page and its scripts are checked for malicious code and known compromise patterns.
  2. Observe the browser. An isolated browser loads the landing page and watches it for a bounded time after load: redirects, injected content and download attempts.
  3. Compare visitor scenarios. The same page is observed under several visitor scenarios, so behavior that depends on the visitor can show up.
  4. Report what was seen. Findings state what was observed and where, and unchecked areas are shown as unchecked, never as clean.
ScanTitan Advanced controls with the content inspection level set to Content and browser observation
The content inspection level that adds browser observation. It shows the control, not a detected infection.

The five visitor scenarios

The scenarios describe who is visiting, not five different browser engines.

Desktop first visit

A new visitor on a desktop browser.

Mobile first visit

A new visitor on a phone.

Crawler-like visit

A request that looks like a search engine crawler.

Returning desktop visit

A visitor who has been to the site before.

Search referral

A visitor who arrives from a search result.

Malware that behaves differently for these visitors can be compared across scenarios. A page that only changes its layout for a phone is a responsive design, not malware, and is not reported as one.

Scope and limits

Browser observation is bounded landing-page observation. It does not run every page or every possible visitor.
  • It applies to supported website malware assessment modes in a website scan.
  • It does not promise to catch arbitrary delayed or time-triggered behavior, coverage of every country or region, or zero false positives.
  • The anonymous Free Malware Scan is a limited 45-second sample. It does not run the full browser assessment.
  • A clean result describes what was checked. It is not a guarantee that a site is free of malware.

Plans and where to start

Create a free account to run the included website security scan. Website plans also include weekly malware monitoring on Free, Professional and Business, and Professional and Business add repeat scans. Consultant is built for assessing client sites and does not include ongoing monitoring.

Read the full website malware scan page, analyse a suspicious file with the Malware Code Analyzer, compare plans and prices, or see the Consultant plan for client assessments. The wider website vulnerability scanner covers vulnerabilities as well as malware.

Behavioral malware detection questions

What is behavioral malware detection?

It checks what a website does, not only what its source contains. ScanTitan inspects the page content and watches the landing page in an isolated browser for redirects, injected content and downloads.

What are the five visitor scenarios?

Desktop first visit, mobile first visit, crawler-like visit, returning desktop visit and search referral. They represent different visitors, not different browsers.

Can it find malware that only shows to some visitors?

Observing several visitor scenarios helps reveal behavior that depends on the visitor. It does not cover every possible audience.

Does it find delayed or time-triggered malware?

The browser observation is bounded to the landing page and a limited time after load. It does not promise to catch every delayed behavior.

Is the Free Malware Scan the same thing?

No. The Free Malware Scan is a limited 45-second public sample. The full browser assessment runs as part of a website scan on your account.

Does a clean result mean my site is safe?

No. It means the checks that ran found nothing. Areas that could not be checked are reported as unchecked.

Why is a changed mobile layout not malware?

Responsive design shows different layouts to different screens. Only suspicious redirects, downloads, injected content and similar behavior are reported.

Check how your website behaves

Create a free account to run the included website security scan and see what the assessment observed.

Create free accountCompare plans