urlscan.io

Retrieve the full analysis report for a completed urlscan.io scan by its UUID, including verdict, DOM snapshot, and network activity.

Search and retrieve multiple urlscan.io scan records, with optional filters for domain, IP, ASN, or verdict, to surface patterns across bulk submissions.

Submit any URL to urlscan.io for deep analysis, capturing screenshots, DOM, network traffic, and a malicious-verdict score — with visibility set to public or private.

Retrieve the full-page screenshot captured during a urlscan.io scan, providing visual evidence of a site's appearance at scan time for reporting or archival.

Retrieve the full HTML DOM captured at scan time, enabling deep analysis of page structure, hidden scripts, and obfuscated content without direct exposure.

Retrieve the numeric malicious-verdict score (0–100) and classification tags for a scan, letting downstream logic branch on threat level without parsing the full report.

Extract the indicators of compromise (IPs, domains, hashes, certificates) identified during a scan, ready for ingestion into SIEM or threat-intel platforms.

Retrieve the full HTTP request/response log and DNS queries captured during a scan, exposing every resource load, redirect chain, and external connection the page made.

Retrieve scans submitted with private visibility, accessible only to your account, giving your team a secure audit trail of internal threat-intel investigations.

Retrieve the technology stack detected on a scanned page (CMS, CDN, ad platforms, analytics), enabling vendor risk assessment and competitive intelligence.

Run a full-text or fielded search across the urlscan.io database of public scans using Elasticsearch query syntax, returning matching scan records for bulk threat research.

Retrieve a lightweight summary of a scan (verdict, primary domain, scan date, screenshot URL) without fetching the full report, for fast triage across many results.

Extract TLS certificate details (issuer, validity, SANs, serial) from a scan result, supporting certificate-based threat attribution and phishing-kit tracking.

Retrieve page title, meta tags, Open Graph data, and other header-level metadata from a scan, useful for validating site identity before taking enforcement action.

Queue multiple URLs for urlscan.io scanning in sequence, enabling large-scale threat-intel campaigns, link audits, or vulnerability sweeps without manual one-by-one submission.

Fires when a urlscan.io scan finishes processing, providing immediate access to verdict, screenshots, and network data for downstream automation.

Fires when a completed scan returns a malicious classification, enabling immediate automated response before the threat can spread or cause damage.

Fires when a scan is classified as a phishing attempt, allowing the agent to initiate takedown workflows and protect users before the link circulates further.

Fires when a private scan is submitted via your API key, enabling real-time tracking of internal investigation activity and audit-log population.

Fires when a scan's numeric malicious-verdict score surpasses a configured threshold (e.g. 50), enabling tiered response based on risk level rather than binary classification.

Fires when a monitored domain appears as the primary or a contacted domain in any new public urlscan.io scan, providing early warning of brand abuse or infrastructure reuse.

Fires when a new scan contains an indicator of compromise — IP, domain, or certificate — that matches an entry in your threat-intel watchlist, connecting new activity to known-bad infrastructure.