ScanMalware

Check links and websites for phishing, scams and malware with ScanMalware's free scanner. Scan a web address and get a clear verdict to branch on, see what the page did and which certificate and software it uses, search millions of past scans, find newly spotted dangerous sites and malware, and watch for fake sites impersonating a brand.

Actions

Action	What it does
Find dangerous sites	List the newest public scans that ScanMalware's AI judged risky, such as phishing pages and scams, optionally only those mentioning a word like a brand name.
Find subdomains	List every hostname under a domain that has appeared in public DNS, found through certificate logs.
Get brand impersonation trend	Count the look-alike sites of a brand seen each day, to spot a new phishing wave.
Get domain scan history	See how often a domain has been scanned on ScanMalware, when it was first and last scanned, and its latest scans.
Get page details	See what a scanned page did when it was opened: where it redirected, which servers and countries it contacted, whether it asks for a password and where its forms send data, plus its cookies, scripts and outside links.
Get recent malware detections	List the files ScanMalware's antivirus caught on scanned pages recently, such as trojans offered as downloads, with the threat name and where it was found.
Get scan verdict	Find out whether a scanned page is dangerous and why: the risk verdict and score, the AI's classification and scam type, the evidence, and an is_dangerous flag to branch on.
Get site certificate	Read the HTTPS certificate a scanned site presented: who it was issued to and by, when it expires, the names it covers, and whether it is valid, expired or self-signed.
Get site technologies	List the software a scanned site runs on, such as WordPress, Cloudflare or jQuery, with versions where they could be told.
Get sites impersonating a brand	List the sites caught pretending to be a brand, such as fake PayPal or Microsoft logins, most recently seen first, with each one's verdict and a link to its report.
List impersonated brands	List the brands ScanMalware watches for look-alike sites, with how many fake sites have been caught for each.
List recent scans	List the newest public scans anyone has run on ScanMalware, newest first, with links to each report.
Scan a website	Open a web address in ScanMalware's browser and check it for phishing, scams and malware.
Search scans	Search every public scan by words in the address or title, or with filters such as domain:paypal.com, ip:1.2.3.4, country:RU or technology:WordPress.

Find dangerous sites

List the newest public scans that ScanMalware's AI judged risky, such as phishing pages and scams, optionally only those mentioning a word like a brand name. Good for a daily threat feed or for spotting look-alikes of your own site.

Inputs

How riskyrisktext: The lowest risk to include. Defaults to high risk.One of: confirmed_scam (Confirmed scams only), high_risk (High risk or worse), moderate_risk (Moderate risk or worse). Default: high_risk.
Scanned inperiodtext: How far back to look. Defaults to the last 24 hours.One of: last24h (Last 24 hours), last7d (Last 7 days), last30d (Last 30 days), any (Any time). Default: last24h.
Mentioningkeywordtext: Only sites whose address or title mentions this, such as a brand name. Leave empty for all.
Number of siteslimitnumber: How many sites to return, from 1 to 100. Defaults to 20.From 1 to 100.

Outputs

has_moretrue/false: Whether there is another page.
pagenumber
periodtext
querytext: The search that was run.
risktext
scan_countnumber: How many scans are in this list.
scanslist
total_scansnumber: How many scans match in all.

Example output

{
  "has_more": false,
  "page": 1,
  "period": "last24h",
  "query": "verdict:(HIGH_RISK OR CONFIRMED_SCAM) submitted:last24h paypal",
  "risk": "high_risk",
  "scan_count": 1,
  "scans": [
    {
      "completed_at": "2026-10-15T00:47:37Z",
      "countries": [
        "US"
      ],
      "final_url": "https://pay-pal-omega.vercel.app/",
      "hosting_providers": [
        "Amazon.com, Inc."
      ],
      "load_time_seconds": 0.41,
      "report_url": "https://scanmalware.com/result/372188eb-447b-42a0-863b-fd6e8b955f1d",
      "scan_id": "372188eb-447b-42a0-863b-fd6e8b955f1d",
      "screenshot_url": "https://scanmalware.com/api/v1/screenshot/372188eb-447b-42a0-863b-fd6e8b955f1d.png",
      "status": "completed",
      "submitted_at": "2026-10-15T00:47:04Z",
      "title": "Log in to your PayPal account",
      "url": "https://pay-pal-omega.vercel.app/",
      "visibility": "public"
    }
  ],
  "total_scans": 1
}

Find subdomains

List every hostname under a domain that has appeared in public DNS, found through certificate logs. Names that no longer resolve are listed apart, since forgotten ones can be taken over by someone else.

Inputs

DomaindomaintextRequired: A domain such as example.com. A full link works too.
Most subdomainslimitnumber: The most subdomains to return, from 1 to 5000. Defaults to 500.From 1 to 5000.

Outputs

domaintext
ip_addresseslist
subdomain_countnumber
subdomainslist
truncatedtrue/false: True when there were more than the limit.
unresolved_countnumber
unresolved_subdomainslist: Names that no longer resolve.

Example output

{
  "domain": "example.com",
  "ip_addresses": [
    "104.20.23.154",
    "172.66.147.243"
  ],
  "subdomain_count": 2,
  "subdomains": [
    "mail.example.com",
    "www.example.com"
  ],
  "truncated": false,
  "unresolved_count": 0,
  "unresolved_subdomains": []
}

Get brand impersonation trend

Count the look-alike sites of a brand seen each day, to spot a new phishing wave. Days with none are left out.

Inputs

BrandbrandtextRequired: The brand to check, most impersonated first. You can also type its short name, such as paypal.
Daysdaysnumber: How many days back to count, from 1 to 730. Defaults to 30.From 1 to 730.

Outputs

brandtext
busiest_daytext
busiest_day_sightingsnumber
daysnumber
timelinelist
total_sightingsnumber

Example output

{
  "brand": "paypal",
  "busiest_day": "2026-10-15",
  "busiest_day_sightings": 3,
  "days": 7,
  "timeline": [
    {
      "date": "2026-10-14",
      "sightings": 1,
      "sites": 1
    },
    {
      "date": "2026-10-15",
      "sightings": 3,
      "sites": 2
    }
  ],
  "total_sightings": 4
}

Get domain scan history

See how often a domain has been scanned on ScanMalware, when it was first and last scanned, and its latest scans.

Inputs

DomaindomaintextRequired: A domain such as example.com. A full link works too.
Number of scanslimitnumber: How many recent scans to list, from 1 to 50. Defaults to 10.From 1 to 50.

Outputs

completed_scansnumber
domaintext
failed_scansnumber
first_scanned_attext
last_scanned_attext
scan_countnumber
scanslist
scans_last_24_hoursnumber
scans_last_30_daysnumber
scans_last_7_daysnumber
total_scansnumber

Example output

{
  "completed_scans": 487,
  "domain": "example.com",
  "failed_scans": 2,
  "first_scanned_at": "2025-09-24T17:30:29Z",
  "last_scanned_at": "2026-10-15T18:02:13Z",
  "scan_count": 1,
  "scans": [
    {
      "completed_at": "2026-10-15T18:02:45Z",
      "countries": [
        "US"
      ],
      "final_url": "https://example.com/",
      "hosting_providers": [
        "Cloudflare, Inc."
      ],
      "load_time_seconds": 0.2,
      "report_url": "https://scanmalware.com/result/461657ef-5829-435e-a0fc-ffad90e8fcbc",
      "scan_id": "461657ef-5829-435e-a0fc-ffad90e8fcbc",
      "screenshot_url": "https://scanmalware.com/api/v1/screenshot/461657ef-5829-435e-a0fc-ffad90e8fcbc.png",
      "status": "completed",
      "submitted_at": "2026-10-15T18:02:13Z",
      "title": "Example Domain",
      "url": "https://example.com",
      "visibility": "public"
    }
  ],
  "scans_last_24_hours": 10,
  "scans_last_30_days": 44,
  "scans_last_7_days": 13,
  "total_scans": 513
}

Get page details

See what a scanned page did when it was opened: where it redirected, which servers and countries it contacted, whether it asks for a password and where its forms send data, plus its cookies, scripts and outside links.

Inputs

Scan IDscan_idtextRequired: The scan to read. Scan a website, Search scans and the other lists return it; a scanmalware.com report link works too.

Outputs

completed_attext
cookie_countnumber
cookie_nameslist
countrieslist
domain_countnumber
domains_contactedlist
errortext
external_linkslist
final_urltext
form_countnumber
form_destinationslist: Where the page's forms send what is typed.
hosting_providerslist
ip_addresseslist
load_time_secondsnumber
page_size_kbnumber
password_field_countnumber: Password boxes on the page.
primary_iptext
redirect_countnumber
redirectslist
report_urltext
request_countnumber
scan_idtext
screenshot_urltext
script_countnumber
script_urlslist
speedtext: Such as Very Fast or Slow.
statustext
submitted_attext
titletext: The page title.
tracker_countnumber
urltext
warning_page_detectedtrue/false: Whether a browser warning page was shown.

Example output

{
  "completed_at": "2026-01-10T19:19:48Z",
  "cookie_count": 4,
  "cookie_names": [
    "oc_sessionPassphrase"
  ],
  "countries": [
    "US"
  ],
  "domain_count": 2,
  "domains_contacted": [
    "cgrgy.pages.dev",
    "mia.nl.tab.digital"
  ],
  "error": null,
  "external_links": [
    "https://a.tab.digital/MItva"
  ],
  "final_url": "https://mia.nl.tab.digital/login",
  "form_count": 1,
  "form_destinations": [
    "https://mia.nl.tab.digital/login"
  ],
  "hosting_providers": [
    "CLOUDFLARENET"
  ],
  "ip_addresses": [
    "172.66.44.235",
    "104.21.3.117"
  ],
  "load_time_seconds": 30.11,
  "page_size_kb": 0.0,
  "password_field_count": 1,
  "primary_ip": "172.66.44.235",
  "redirect_count": 1,
  "redirects": [
    {
      "from_url": "http://cgrgy.pages.dev/",
      "status_code": 307,
      "to_url": "https://cgrgy.pages.dev/"
    }
  ],
  "report_url": "https://scanmalware.com/result/0d403c95-5cd3-48a8-bf28-ab5060df3ac1",
  "request_count": 2,
  "scan_id": "0d403c95-5cd3-48a8-bf28-ab5060df3ac1",
  "screenshot_url": "https://scanmalware.com/api/v1/screenshot/0d403c95-5cd3-48a8-bf28-ab5060df3ac1.png",
  "script_count": 0,
  "script_urls": [],
  "speed": "Slow",
  "status": "completed",
  "submitted_at": "2026-01-10T19:17:02Z",
  "title": "Login \u2013 Nextcloud",
  "tracker_count": 0,
  "url": "http://cgrgy.pages.dev/",
  "warning_page_detected": false
}

Get recent malware detections

List the files ScanMalware's antivirus caught on scanned pages recently, such as trojans offered as downloads, with the threat name and where it was found.

Inputs

Hours to look backhoursnumber: From 1 to 168 (a week). Defaults to 24.From 1 to 168.
Most detectionslimitnumber: From 1 to 1000. Defaults to 50.From 1 to 1000.
Include files too big to checkinclude_size_limit_noticestrue/false: The antivirus also reports files it was too big to read. They aren't known to be harmful, so they're left out unless you turn this on.Default: false.

Outputs

detection_countnumber
detectionslist
hoursnumber
threat_nameslist

Example output

{
  "detection_count": 1,
  "detections": [
    {
      "detected_at": "2026-10-11T20:12:32Z",
      "file_size_bytes": 558592,
      "file_type": "application/octet-stream",
      "report_url": "https://scanmalware.com/result/4902d2ab-afed-4437-9295-f76198953bf3",
      "scan_id": "4902d2ab-afed-4437-9295-f76198953bf3",
      "threat_name": "Win.Trojan.Havoc-10035024-0",
      "url": "https://ed75a310.infinityindians.pages.dev/ktool.exe"
    }
  ],
  "hours": 24,
  "threat_names": [
    "Win.Trojan.Havoc-10035024-0"
  ]
}

Get scan verdict

Find out whether a scanned page is dangerous and why: the risk verdict and score, the AI's classification and scam type, the evidence, and an is_dangerous flag to branch on. A scan that is still running reports how far along it is instead.

Inputs

Scan IDscan_idtextRequired: The scan to read. Scan a website, Search scans and the other lists return it; a scanmalware.com report link works too.

Outputs

ai_analyzed_attext: When the AI looked (UTC).
ai_classificationtext: LEGITIMATE, LOW_RISK, MODERATE_RISK, HIGH_RISK, CONFIRMED_SCAM or NOT_ASSESSED.
ai_classification_labeltext: The AI classification in plain words.
ai_confidencenumber: How sure the AI is, in percent.
ai_key_evidencelist: What the AI based it on.
ai_recommended_actiontext: What the AI recommends.
ai_risk_scorenumber: The AI's risk score from 0 to 10.
ai_safety_factorslist: What speaks for the page.
ai_scam_typetext: The kind of scam, such as Phishing.
ai_summarytext: The AI's one-line verdict.
certificate_validtrue/false: Whether HTTPS was valid.
completed_attext: When the scan finished (UTC).
final_urltext: Where the page ended up after any redirects.
finishedtrue/false: Whether the scan has finished.
is_dangeroustrue/false: True when the verdict is high risk or worse, or the AI calls it high risk or a confirmed scam.
load_time_secondsnumber: How long the page took to load.
progress_percentnumber: How far along the scan is.
recommendationslist: What to do about it.
redirect_countnumber: How many redirects there were.
report_urltext: The full report on scanmalware.com.
risk_factorslist: Why the page looks risky.
risk_leveltext: low, medium, high or malicious.
risk_scorenumber: Risk score from 0 (safe) to 100.
scan_idtext: The scan's ID.
screenshot_urltext: A screenshot of the page.
statustext: queued, processing, completed or failed.
technology_countnumber: How many technologies were found.
tracker_countnumber: How many trackers were found.
urltext: The address that was scanned.
verdicttext: ScanMalware's verdict, such as Low Risk or High Risk.

Example output

{
  "ai_analyzed_at": "2026-01-10T19:20:18Z",
  "ai_classification": "CONFIRMED_SCAM",
  "ai_classification_label": "Confirmed scam",
  "ai_confidence": 100,
  "ai_key_evidence": [
    "Login form with password field present on the malicious domain"
  ],
  "ai_recommended_action": "Avoid interaction and report as scam",
  "ai_risk_score": 10,
  "ai_safety_factors": [],
  "ai_scam_type": "Phishing",
  "ai_summary": "Confirmed phishing scam harvesting Nextcloud credentials via a malicious domain.",
  "certificate_valid": true,
  "completed_at": "2026-01-10T19:19:48Z",
  "final_url": "https://mia.nl.tab.digital/login",
  "finished": true,
  "is_dangerous": true,
  "load_time_seconds": 30.11,
  "progress_percent": 100,
  "recommendations": [
    "Avoid visiting this website - high security risk detected"
  ],
  "redirect_count": 1,
  "report_url": "https://scanmalware.com/result/0d403c95-5cd3-48a8-bf28-ab5060df3ac1",
  "risk_factors": [
    "Mixed Content",
    "Threat-intel IoC on scanned domain (apt redwolf (malware)): mia.nl.tab.digital"
  ],
  "risk_level": "high",
  "risk_score": 60,
  "scan_id": "0d403c95-5cd3-48a8-bf28-ab5060df3ac1",
  "screenshot_url": "https://scanmalware.com/api/v1/screenshot/0d403c95-5cd3-48a8-bf28-ab5060df3ac1.png",
  "status": "completed",
  "technology_count": 2,
  "tracker_count": 0,
  "url": "http://cgrgy.pages.dev/",
  "verdict": "High Risk"
}

Get site certificate

Read the HTTPS certificate a scanned site presented: who it was issued to and by, when it expires, the names it covers, and whether it is valid, expired or self-signed.

Inputs

Scan IDscan_idtextRequired: The scan to read. Scan a website, Search scans and the other lists return it; a scanmalware.com report link works too.

Outputs

days_until_expirynumber
fingerprint_sha256text
is_expiredtrue/false
is_lets_encrypttrue/false
is_self_signedtrue/false
is_validtrue/false
is_wildcardtrue/false
issued_totext: The site name on it.
issuertext
issuer_organizationtext
key_algorithmtext
key_sizenumber
names_coveredlist
organizationtext
report_urltext
scan_idtext
serial_numbertext
signature_algorithmtext
valid_fromtext
valid_untiltext

Example output

{
  "days_until_expiry": 71,
  "fingerprint_sha256": "85ca6ab068e9bcce88b6c4aa3c47f7d17228134a457f870d3800e6223a0df07a",
  "is_expired": false,
  "is_lets_encrypt": false,
  "is_self_signed": false,
  "is_valid": true,
  "is_wildcard": true,
  "issued_to": "example.com",
  "issuer": "Cloudflare TLS Issuing ECC CA 3",
  "issuer_organization": "SSL Corporation",
  "key_algorithm": "ECDSA",
  "key_size": 256,
  "names_covered": [
    "example.com",
    "*.example.com"
  ],
  "organization": null,
  "report_url": "https://scanmalware.com/result/461657ef-5829-435e-a0fc-ffad90e8fcbc",
  "scan_id": "461657ef-5829-435e-a0fc-ffad90e8fcbc",
  "serial_number": "2569673129085639595562975411803018896",
  "signature_algorithm": "ecdsa-with-SHA256",
  "valid_from": "2026-09-26T22:49:11Z",
  "valid_until": "2026-12-25T22:56:35Z"
}

Get site technologies

List the software a scanned site runs on, such as WordPress, Cloudflare or jQuery, with versions where they could be told.

Inputs

Scan IDscan_idtextRequired: The scan to read. Scan a website, Search scans and the other lists return it; a scanmalware.com report link works too.

Outputs

scan_idtext
technologieslist
technology_countnumber
technology_nameslist

Example output

{
  "scan_id": "461657ef-5829-435e-a0fc-ffad90e8fcbc",
  "technologies": [
    {
      "confidence": 40,
      "name": "Cloudflare",
      "version": null,
      "website": null
    },
    {
      "confidence": 40,
      "name": "HTTP/3",
      "version": null,
      "website": null
    }
  ],
  "technology_count": 2,
  "technology_names": [
    "Cloudflare",
    "HTTP/3"
  ]
}

Get sites impersonating a brand

List the sites caught pretending to be a brand, such as fake PayPal or Microsoft logins, most recently seen first, with each one's verdict and a link to its report.

Inputs

BrandbrandtextRequired: The brand to check, most impersonated first. You can also type its short name, such as paypal.
Number of siteslimitnumber: From 1 to 1000. Defaults to 25.From 1 to 1000.

Outputs

brandtext
brand_nametext
last_seentext
official_domainslist
sectortext
sighting_countnumber
sightingslist
total_hostsnumber: How many different fake sites were caught.
total_sightingsnumber

Example output

{
  "brand": "paypal",
  "brand_name": "PayPal",
  "last_seen": "2026-10-15",
  "official_domains": [
    "paypal.com",
    "paypalobjects.com"
  ],
  "sector": "payment",
  "sighting_count": 1,
  "sightings": [
    {
      "ai_classification": "CONFIRMED_SCAM",
      "ai_risk_score": 9,
      "first_seen": "2026-08-23T00:47:04Z",
      "host": "pay-pal-omega.vercel.app",
      "last_seen": "2026-10-15T00:47:37Z",
      "report_url": "https://scanmalware.com/result/372188eb-447b-42a0-863b-fd6e8b955f1d",
      "risk_level": "malicious",
      "risk_score": 80,
      "scan_id": "372188eb-447b-42a0-863b-fd6e8b955f1d",
      "times_seen": 12,
      "title": "Log in to your PayPal account",
      "verdict": "Malicious"
    }
  ],
  "total_hosts": 34,
  "total_sightings": 102
}

List impersonated brands

List the brands ScanMalware watches for look-alike sites, with how many fake sites have been caught for each. Filter by name or industry.

Inputs

Brand namesearchtext: Only brands whose name or website contains this.
Industrysectortext: Only brands in this industry.
Only brands with fake sitesonly_impersonatedtrue/false: Leave out brands no fake site has been caught for yet.Default: false.
Sort bysorttext: Which brands come first. Defaults to most sightings.One of: sightings (Most sightings), hosts (Most fake sites), recent (Most recently seen), name (Name A to Z). Default: sightings.
Number of brandslimitnumber: From 1 to 1000. Defaults to 50.From 1 to 1000.

Outputs

brand_countnumber
brandslist
total_brandsnumber

Example output

{
  "brand_count": 1,
  "brands": [
    {
      "brand": "paypal",
      "homepage_url": "https://paypal.com",
      "impersonating_sites": 34,
      "last_seen": "2026-10-15",
      "name": "PayPal",
      "official_domains": [
        "paypal.com",
        "paypalobjects.com"
      ],
      "sector": "payment",
      "sightings": 102
    }
  ],
  "total_brands": 11
}

List recent scans

List the newest public scans anyone has run on ScanMalware, newest first, with links to each report.

Inputs

Number of scanslimitnumber: How many scans to return, from 1 to 100. Defaults to 20.From 1 to 100.
Pagepagenumber: Which page of results to return. Defaults to 1.From 1 to 10000.

Outputs

has_moretrue/false: Whether there is another page.
pagenumber
scan_countnumber: How many scans are in this list.
scanslist
total_scansnumber: How many scans match in all.

Example output

{
  "has_more": true,
  "page": 1,
  "scan_count": 1,
  "scans": [
    {
      "completed_at": "2026-10-15T18:02:45Z",
      "countries": [
        "US"
      ],
      "final_url": "https://example.com/",
      "hosting_providers": [
        "Cloudflare, Inc."
      ],
      "load_time_seconds": 0.2,
      "report_url": "https://scanmalware.com/result/461657ef-5829-435e-a0fc-ffad90e8fcbc",
      "scan_id": "461657ef-5829-435e-a0fc-ffad90e8fcbc",
      "screenshot_url": "https://scanmalware.com/api/v1/screenshot/461657ef-5829-435e-a0fc-ffad90e8fcbc.png",
      "status": "completed",
      "submitted_at": "2026-10-15T18:02:13Z",
      "title": "Example Domain",
      "url": "https://example.com",
      "visibility": "public"
    }
  ],
  "total_scans": 705223
}

Scan a website

Open a web address in ScanMalware's browser and check it for phishing, scams and malware. By default the step waits for the result, usually 20 to 60 seconds, and returns the verdict, an is_dangerous flag to branch on and a link to the full report. Set the wait to 0 to get the scan ID back at once and read the verdict later with Get scan verdict.

Inputs

Web addressurltextRequired: The page to scan. A bare domain such as example.com works too. Only scan addresses you're allowed to check.
Who can see itvisibilitytext: Public scans appear in ScanMalware's listings and search. Unlisted scans stay out of them, but anyone with the scan ID or link can still open them.One of: public, unlisted. Default: public.
Wait for the result (seconds)wait_secondsnumber: How long to wait for the scan to finish, from 0 to 300. Defaults to 120. Use 0 to return straight away.From 0 to 300. Default: 120.

Outputs

ai_analyzed_attext: When the AI looked (UTC).
ai_classificationtext: LEGITIMATE, LOW_RISK, MODERATE_RISK, HIGH_RISK, CONFIRMED_SCAM or NOT_ASSESSED.
ai_classification_labeltext: The AI classification in plain words.
ai_confidencenumber: How sure the AI is, in percent.
ai_key_evidencelist: What the AI based it on.
ai_recommended_actiontext: What the AI recommends.
ai_risk_scorenumber: The AI's risk score from 0 to 10.
ai_safety_factorslist: What speaks for the page.
ai_scam_typetext: The kind of scam, such as Phishing.
ai_summarytext: The AI's one-line verdict.
certificate_validtrue/false: Whether HTTPS was valid.
completed_attext: When the scan finished (UTC).
errortext: Why the scan failed, if it did.
final_urltext: Where the page ended up after any redirects.
finishedtrue/false: Whether the scan has finished.
is_dangeroustrue/false: True when the verdict is high risk or worse, or the AI calls it high risk or a confirmed scam.
load_time_secondsnumber: How long the page took to load.
progress_percentnumber: How far along the scan is.
recommendationslist: What to do about it.
redirect_countnumber: How many redirects there were.
report_urltext: The full report on scanmalware.com.
risk_factorslist: Why the page looks risky.
risk_leveltext: low, medium, high or malicious.
risk_scorenumber: Risk score from 0 (safe) to 100.
scan_idtext: The scan's ID.
screenshot_urltext: A screenshot of the page.
statustext: queued, processing, completed or failed.
submitted_attext: When the scan was started (UTC).
technology_countnumber: How many technologies were found.
tracker_countnumber: How many trackers were found.
urltext: The address that was scanned.
verdicttext: ScanMalware's verdict, such as Low Risk or High Risk.
visibilitytext: public or unlisted.

Example output

{
  "ai_analyzed_at": "2026-10-15T18:03:03Z",
  "ai_classification": "LEGITIMATE",
  "ai_classification_label": "Legitimate",
  "ai_confidence": 95,
  "ai_key_evidence": [
    "Domain ranked #7,087 in Cisco Umbrella"
  ],
  "ai_recommended_action": "Safe to use",
  "ai_risk_score": 0,
  "ai_safety_factors": [
    "No forms or interactive credential elements"
  ],
  "ai_scam_type": null,
  "ai_summary": "Low-risk scan on a well-ranked domain.",
  "certificate_valid": true,
  "completed_at": "2026-10-15T18:02:45Z",
  "error": null,
  "final_url": "https://example.com/",
  "finished": true,
  "is_dangerous": false,
  "load_time_seconds": 0.2,
  "progress_percent": 100,
  "recommendations": [],
  "redirect_count": 0,
  "report_url": "https://scanmalware.com/result/461657ef-5829-435e-a0fc-ffad90e8fcbc",
  "risk_factors": [],
  "risk_level": "low",
  "risk_score": 23,
  "scan_id": "461657ef-5829-435e-a0fc-ffad90e8fcbc",
  "screenshot_url": "https://scanmalware.com/api/v1/screenshot/461657ef-5829-435e-a0fc-ffad90e8fcbc.png",
  "status": "completed",
  "submitted_at": "2026-10-15T18:02:13Z",
  "technology_count": 3,
  "tracker_count": 0,
  "url": "https://example.com",
  "verdict": "Low Risk",
  "visibility": "public"
}

Search scans

Search every public scan by words in the address or title, or with filters such as domain:paypal.com, ip:1.2.3.4, country:RU or technology:WordPress. Combine them with AND, OR and NOT.

Inputs

Search forquerytextRequired: Words, filters or both. The full list of filters is at https://scanmalware.com/api-docs.
Sort bysorttext: Which scans come first. Defaults to newest.One of: newest (Newest first), oldest (Oldest first), url (Address A to Z), load_time (Slowest to load), ip_count (Most IP addresses). Default: newest.
Number of scanslimitnumber: How many scans to return, from 1 to 100. Defaults to 20.From 1 to 100.
Pagepagenumber: Which page of results to return. Defaults to 1.From 1 to 1000.

Outputs

has_moretrue/false: Whether there is another page.
pagenumber
querytext
scan_countnumber: How many scans are in this list.
scanslist
total_scansnumber: How many scans match in all.

Example output

{
  "has_more": true,
  "page": 1,
  "query": "domain:example.com",
  "scan_count": 1,
  "scans": [
    {
      "completed_at": "2026-10-15T18:02:45Z",
      "countries": [
        "US"
      ],
      "final_url": "https://example.com/",
      "hosting_providers": [
        "Cloudflare, Inc."
      ],
      "load_time_seconds": 0.2,
      "report_url": "https://scanmalware.com/result/461657ef-5829-435e-a0fc-ffad90e8fcbc",
      "scan_id": "461657ef-5829-435e-a0fc-ffad90e8fcbc",
      "screenshot_url": "https://scanmalware.com/api/v1/screenshot/461657ef-5829-435e-a0fc-ffad90e8fcbc.png",
      "status": "completed",
      "submitted_at": "2026-10-15T18:02:13Z",
      "title": "Example Domain",
      "url": "https://example.com",
      "visibility": "public"
    }
  ],
  "total_scans": 513
}

ActionsCopy Anchor Link

Find dangerous sitesCopy Anchor Link

Inputs

Outputs

Find subdomainsCopy Anchor Link

Inputs

Outputs

Get brand impersonation trendCopy Anchor Link

Inputs

Outputs

Get domain scan historyCopy Anchor Link

Inputs

Outputs

Get page detailsCopy Anchor Link

Inputs

Outputs

Get recent malware detectionsCopy Anchor Link

Inputs

Outputs

Get scan verdictCopy Anchor Link

Inputs

Outputs

Get site certificateCopy Anchor Link

Inputs

Outputs

Get site technologiesCopy Anchor Link

Inputs

Outputs

Get sites impersonating a brandCopy Anchor Link

Inputs

Outputs

List impersonated brandsCopy Anchor Link

Inputs

Outputs

List recent scansCopy Anchor Link

Inputs

Outputs

Scan a websiteCopy Anchor Link

Inputs

Outputs

Search scansCopy Anchor Link

Inputs

Outputs

On this page

Actions

Find dangerous sites

Find subdomains

Get brand impersonation trend

Get domain scan history

Get page details

Get recent malware detections

Get scan verdict

Get site certificate

Get site technologies

Get sites impersonating a brand

List impersonated brands

List recent scans

Scan a website

Search scans