An analysis apparatus configured to analyze a content and a script code on a website, wherein the analysis apparatus comprises: a transfer path matching unit configured to: be provided with, as input: - an access log (La) for a Uniform Resource Locator, URL, of a website as an analysis target on a real browser that is a browser of a real system, and - an access log (Lb) for the URL of a website as an analysis target on a pseudo-browser that simulates an environment of the real browser; create respective transfer graphs (P1, P11, P12, P13) from the access logs (La, Lb) for the real browser and the pseudo-browser; and identify, as a specific transfer path, a transfer path that is not transferred to a malicious URL on the pseudo-browser where the transfer path is transferred to the malicious URL on the real browser, based on the malicious URL, by matching respective transfer paths (P1, P11, P12, P13) in the created transfer graphs (P1, P11, P12, P13) to one another; and an identification unit configured to identify a terminal URL on a common node between the transfer path on the real browser and the transfer path on the pseudo-browser and to identify an analysis avoidance code that avoids analysis by utilizing a browser-specific function or an implementation difference between the real-browser and the pseudo-browser, among script codes that are executed on the website, based on the specific transfer path. a transfer path matching unit configured to: be provided with, as input: - an access log (La) for a Uniform Resource Locator, URL, of a website as an analysis target on a real browser that is a browser of a real system, and - an access log (Lb) for the URL of a website as an analysis target on a pseudo-browser that simulates an environment of the real browser; create respective transfer graphs (P1, P11, P12, P13) from the access logs (La, Lb) for the real browser and the pseudo-browser; and identify, as a specific transfer path, a transfer path that is not transferred to a malicious URL on the pseudo-browser where the transfer path is transferred to the malicious URL on the real browser, based on the malicious URL, by matching respective transfer paths (P1, P11, P12, P13) in the created transfer graphs (P1, P11, P12, P13) to one another; and be provided with, as input: - an access log (La) for a Uniform Resource Locator, URL, of a website as an analysis target on a real browser that is a browser of a real system, and - an access log (Lb) for the URL of a website as an analysis target on a pseudo-browser that simulates an environment of the real browser; - an access log (La) for a Uniform Resource Locator, URL, of a website as an analysis target on a real browser that is a browser of a real system, and - an access log (Lb) for the URL of a website as an analysis target on a pseudo-browser that simulates an environment of the real browser; create respective transfer graphs (P1, P11, P12, P13) from the access logs (La, Lb) for the real browser and the pseudo-browser; and identify, as a specific transfer path, a transfer path that is not transferred to a malicious URL on the pseudo-browser where the transfer path is transferred to the malicious URL on the real browser, based on the malicious URL, by matching respective transfer paths (P1, P11, P12, P13) in the created transfer graphs (P1, P11, P12, P13) to one another; and an identification unit configured to identify a terminal URL on a common node between the transfer path on the real browser and the transfer path on the pseudo-browser and to identify an analysis avoidance code that avoids analysis by utilizing a browser-specific function or an implementation difference between the real-browser and the pseudo-browser, among script codes that are executed on the website, based on the specific transfer path.