This tool is intended for educational purposes only.
A Python script for automated risk assessment of URLs using the Zulu Zscaler web service.
This tool allows you to automate the risk assessment of URLs, which you would otherwise have to enter manually at zulu.zscaler.com. It fetches and parses the same results you would see in the browser, making it easy to integrate Zulu Zscaler's analysis into your own workflows.
- Automated URL analysis via Zulu Zscaler
- Customizable list of known safe domains (to skip analysis)
- SSL certificate verification enabled by default
- Option to disable SSL verification with
--no-verify - Command-line interface (CLI) for easy usage
- Python 3.9+
requestslibrary (>=2.32.0 for security fixes)
Clone this repository and install the required dependencies:
pip install -r requirements.txtpython zulu_analyze.py <url> [--safe-domains domain1 domain2 ...] [--no-verify] [--force-rescan]<url>: The URL to analyze (e.g.https://github.com)--safe-domains: (Optional) List of domains considered safe (skips analysis if matched)--no-verify: (Optional) Disable SSL certificate verification (not recommended)--force-rescan: (Optional) Force a fresh scan instead of using cached results
Analyze a URL with default settings:
python zulu_analyze.py https://github.comAnalyze a URL and skip analysis for custom safe domains:
python zulu_analyze.py https://github.com --safe-domains github.com example.comForce a fresh scan (ignore cached results):
python zulu_analyze.py https://github.com --force-rescanAnalyze a URL and disable SSL verification:
python zulu_analyze.py https://github.com --no-verifyExample output (click to expand)
{
"url": "https://github.com",
"status_code": 200,
"content_type": "text/html; charset=UTF-8",
"last_performed": "2025-06-19 11:46:51.250761",
"score": 0,
"classification": "Benign",
"analysis": {
"redirections": "https://github.com/",
"http_status": "200",
"content_size": "286919 bytes",
"content_type": "text/html; charset=utf-8",
"ip_address": "140.82.112.4",
"country": "US",
"web_server": "github.com",
"domain_history": [
{
"date": "2025-05-22",
"report_id": "6f9b5b13-e869-4489-b542-b04d5546dd3b",
"url": "https://github.com/readme"
},
{
"date": "2025-05-22",
"report_id": "4f69cf70-d551-4c7d-a0f6-50323a81e632",
"url": "https://resources.github.com/learn/pathways"
},
{
"date": "2025-05-22",
"report_id": "2496b0b-5663-4b38-98a0-9cd2336ec6d3",
"url": "https://github.com/customer-stories/figma"
},
{
"date": "2025-05-22",
"report_id": "2539b0d1-33f9-4c57-9e7e-8b840e1a1417",
"url": "https://codeload.github.com/northerntrust-internal/apm000130"
},
{
"date": "2025-05-22",
"report_id": "cdc7c0f8-a749-4802-a6e8-7af29b8661e5",
"url": "https://www.github.com"
}
]
},
"content_checks": [
{
"test": "Known Bad Hash",
"description": "56f98d3a14064e12f64471ad364401ad",
"risk": "0"
},
{
"test": "Phishing Heuristic",
"description": "Not a phishing page",
"risk": "0"
},
{
"test": "Content Inspection",
"description": "No match",
"risk": "0"
},
{
"test": "Park/Disabled Domain",
"description": "No match",
"risk": "0"
}
],
"url_checks": [
{
"test": "Non-Standard Port",
"description": "HTTP",
"risk": "0"
},
{
"test": "SSL-Cert Check",
"description": "Valid Certificate",
"risk": "-15"
},
{
"test": "Suspicious URL Pattern",
"description": "No match",
"risk": "0"
},
{
"test": "Top-Level Domain Risk",
"description": "No match",
"risk": "0"
},
{
"test": "File-Type Risk",
"description": "",
"risk": "0"
},
{
"test": "Zscaler Inline",
"description": "No match",
"risk": "0"
},
{
"test": "VirusTotal Content Check",
"description": "Positives: 0",
"risk": "0"
},
{
"test": "Geo-location Risk",
"description": "",
"risk": "0"
},
{
"test": "Zscaler Malicious URL",
"description": "No Match",
"risk": "0"
}
],
"host_checks": [
{
"test": "Zscaler Malicious IP",
"description": "",
"risk": "0"
},
{
"test": "NetBlock Size Risk",
"description": "Netblock size: 4096",
"risk": "0"
},
{
"test": "VirusTotal IP Submission",
"description": "Badness ratio: 0.0",
"risk": "0"
},
{
"test": "SURBL Block",
"description": "No match",
"risk": "0"
},
{
"test": "Autonomous System Risk",
"description": "ASN:",
"risk": "0"
}
]
}ZuluZscalerclass: Handles session, safe domain logic, and parsing of Zulu Zscaler results.main()function: CLI entry point, argument parsing, and result output.
- SSL certificate verification is enabled by default for your safety.
- Only use
--no-verifyif you understand the risks (e.g. for debugging in trusted environments).
This tool includes several security measures to prevent abuse:
-
SSRF Protection: Direct IP addresses (e.g.,
127.0.0.1,10.0.0.1,192.168.x.x,169.254.169.254) are blocked to prevent Server-Side Request Forgery attacks. -
Scheme Validation: Only
http://andhttps://URLs are allowed. Dangerous schemes likefile://,javascript:,ftp://, etc. are blocked. -
Hostname Validation: URL hostnames are validated to contain only valid DNS characters (alphanumeric, hyphens, dots).
-
SSL Verification: Enabled by default. A warning is printed to stderr if you disable it with
--no-verify. -
Rate Limiting: The tool handles HTTP 429 (Rate Limited) responses gracefully.
To verify the security protections are working correctly:
python test_zulu_analyze.pyThis will run 29 tests covering URL validation, SSRF protection, scheme blocking, and more.
- Never disable SSL verification in production environments
- Keep
requestslibrary updated to get security patches (requires >=2.32.0) - Use the safe domains feature to skip analysis for your trusted internal domains
- Report security issues responsibly if you find any vulnerabilities
Feel free to open issues or pull requests for improvements, bug fixes, or new features!
- This project uses the public web service provided by Zulu Zscaler for URL risk analysis.
- All credit for the analysis engine and data goes to Zscaler, Inc. See their website for more information and terms of use.
MIT License
This project is not affiliated with or endorsed by Zscaler. Use at your own risk.
Note to Zscaler: If you are a representative of Zscaler and wish for this repository to be taken down, please contact the maintainer and it will be removed promptly.
Please note: Only individual, occasional queries are permitted. Automated mass queries, scraping, or any use that could degrade the Zulu Zscaler service or violate their Acceptable Use Policy is strictly prohibited. Always respect the terms of service of zulu.zscaler.com and use this tool responsibly.