Lookyloo Web Capture & Investigation on Ubuntu 24.04 LTS

Overview

Lookyloo is a web page capture and investigation tool built by CIRCL, the Computer Incident Response Center Luxembourg, and used by CERTs and security teams to triage phishing and malicious sites. You give it a URL and it visits the page with a genuine headless browser, recording the complete journey: the redirect chain, every domain and resource the page pulls in, the cookies it sets, the scripts it runs and a screenshot of what a victim would actually see. The result is an interactive tree where each node can be expanded and inspected, so an analyst can see at a glance which third party actually delivers the payload, where credentials would be posted, or how a redirector hops between disposable domains. Captures can be kept, compared, re-run and shared with colleagues, and a self documented REST API plus the pylookyloo client let you submit and retrieve captures from your own tooling and automations.

Common uses

• Phishing and malicious site triage: see the full redirect chain and what a victim's browser would load
• Safe URL detonation for SOC and CERT analysts, without touching the suspicious site from your own workstation
• Automated capture pipelines via the REST API for abuse desks and threat intelligence teams

See it running

Real screenshots taken while testing this image against its deployment guide.