# ScanMalware

> Check links and websites for phishing, scams and malware with ScanMalware's free scanner. Scan a web address and get a clear verdict to branch on, see what the page did and which certificate and software it uses, search millions of past scans, find newly spotted dangerous sites and malware, and watch for fake sites impersonating a brand.

App · 14 actions. Web page: https://docs.lodol.com/docs/integrations/scanmalware

## Actions

### Find dangerous sites

List the newest public scans that ScanMalware's AI judged risky, such as phishing pages and scams, optionally only those mentioning a word like a brand name. Good for a daily threat feed or for spotting look-alikes of your own site.

**Inputs**

- How risky (`risk`, text): The lowest risk to include. Defaults to high risk. One of: `confirmed_scam` (Confirmed scams only), `high_risk` (High risk or worse), `moderate_risk` (Moderate risk or worse). Default: `high_risk`.
- Scanned in (`period`, text): How far back to look. Defaults to the last 24 hours. One of: `last24h` (Last 24 hours), `last7d` (Last 7 days), `last30d` (Last 30 days), `any` (Any time). Default: `last24h`.
- Mentioning (`keyword`, text): Only sites whose address or title mentions this, such as a brand name. Leave empty for all.
- Number of sites (`limit`, number): How many sites to return, from 1 to 100. Defaults to 20. From 1 to 100.

**Outputs**

- `has_more` (true/false): Whether there is another page.
- `page` (number)
- `period` (text)
- `query` (text): The search that was run.
- `risk` (text)
- `scan_count` (number): How many scans are in this list.
- `scans` (list)
- `total_scans` (number): How many scans match in all.

**Example output**

```json
{
  "has_more": false,
  "page": 1,
  "period": "last24h",
  "query": "verdict:(HIGH_RISK OR CONFIRMED_SCAM) submitted:last24h paypal",
  "risk": "high_risk",
  "scan_count": 1,
  "scans": [
    {
      "completed_at": "2026-10-15T00:47:37Z",
      "countries": [
        "US"
      ],
      "final_url": "https://pay-pal-omega.vercel.app/",
      "hosting_providers": [
        "Amazon.com, Inc."
      ],
      "load_time_seconds": 0.41,
      "report_url": "https://scanmalware.com/result/372188eb-447b-42a0-863b-fd6e8b955f1d",
      "scan_id": "372188eb-447b-42a0-863b-fd6e8b955f1d",
      "screenshot_url": "https://scanmalware.com/api/v1/screenshot/372188eb-447b-42a0-863b-fd6e8b955f1d.png",
      "status": "completed",
      "submitted_at": "2026-10-15T00:47:04Z",
      "title": "Log in to your PayPal account",
      "url": "https://pay-pal-omega.vercel.app/",
      "visibility": "public"
    }
  ],
  "total_scans": 1
}
```

### Find subdomains

List every hostname under a domain that has appeared in public DNS, found through certificate logs. Names that no longer resolve are listed apart, since forgotten ones can be taken over by someone else.

**Inputs**

- Domain (`domain`, text, required): A domain such as example.com. A full link works too.
- Most subdomains (`limit`, number): The most subdomains to return, from 1 to 5000. Defaults to 500. From 1 to 5000.

**Outputs**

- `domain` (text)
- `ip_addresses` (list)
- `subdomain_count` (number)
- `subdomains` (list)
- `truncated` (true/false): True when there were more than the limit.
- `unresolved_count` (number)
- `unresolved_subdomains` (list): Names that no longer resolve.

**Example output**

```json
{
  "domain": "example.com",
  "ip_addresses": [
    "104.20.23.154",
    "172.66.147.243"
  ],
  "subdomain_count": 2,
  "subdomains": [
    "mail.example.com",
    "www.example.com"
  ],
  "truncated": false,
  "unresolved_count": 0,
  "unresolved_subdomains": []
}
```

### Get brand impersonation trend

Count the look-alike sites of a brand seen each day, to spot a new phishing wave. Days with none are left out.

**Inputs**

- Brand (`brand`, text, required): The brand to check, most impersonated first. You can also type its short name, such as paypal.
- Days (`days`, number): How many days back to count, from 1 to 730. Defaults to 30. From 1 to 730.

**Outputs**

- `brand` (text)
- `busiest_day` (text)
- `busiest_day_sightings` (number)
- `days` (number)
- `timeline` (list)
- `total_sightings` (number)

**Example output**

```json
{
  "brand": "paypal",
  "busiest_day": "2026-10-15",
  "busiest_day_sightings": 3,
  "days": 7,
  "timeline": [
    {
      "date": "2026-10-14",
      "sightings": 1,
      "sites": 1
    },
    {
      "date": "2026-10-15",
      "sightings": 3,
      "sites": 2
    }
  ],
  "total_sightings": 4
}
```

### Get domain scan history

See how often a domain has been scanned on ScanMalware, when it was first and last scanned, and its latest scans.

**Inputs**

- Domain (`domain`, text, required): A domain such as example.com. A full link works too.
- Number of scans (`limit`, number): How many recent scans to list, from 1 to 50. Defaults to 10. From 1 to 50.

**Outputs**

- `completed_scans` (number)
- `domain` (text)
- `failed_scans` (number)
- `first_scanned_at` (text)
- `last_scanned_at` (text)
- `scan_count` (number)
- `scans` (list)
- `scans_last_24_hours` (number)
- `scans_last_30_days` (number)
- `scans_last_7_days` (number)
- `total_scans` (number)

**Example output**

```json
{
  "completed_scans": 487,
  "domain": "example.com",
  "failed_scans": 2,
  "first_scanned_at": "2025-09-24T17:30:29Z",
  "last_scanned_at": "2026-10-15T18:02:13Z",
  "scan_count": 1,
  "scans": [
    {
      "completed_at": "2026-10-15T18:02:45Z",
      "countries": [
        "US"
      ],
      "final_url": "https://example.com/",
      "hosting_providers": [
        "Cloudflare, Inc."
      ],
      "load_time_seconds": 0.2,
      "report_url": "https://scanmalware.com/result/461657ef-5829-435e-a0fc-ffad90e8fcbc",
      "scan_id": "461657ef-5829-435e-a0fc-ffad90e8fcbc",
      "screenshot_url": "https://scanmalware.com/api/v1/screenshot/461657ef-5829-435e-a0fc-ffad90e8fcbc.png",
      "status": "completed",
      "submitted_at": "2026-10-15T18:02:13Z",
      "title": "Example Domain",
      "url": "https://example.com",
      "visibility": "public"
    }
  ],
  "scans_last_24_hours": 10,
  "scans_last_30_days": 44,
  "scans_last_7_days": 13,
  "total_scans": 513
}
```

### Get page details

See what a scanned page did when it was opened: where it redirected, which servers and countries it contacted, whether it asks for a password and where its forms send data, plus its cookies, scripts and outside links.

**Inputs**

- Scan ID (`scan_id`, text, required): The scan to read. Scan a website, Search scans and the other lists return it; a scanmalware.com report link works too.

**Outputs**

- `completed_at` (text)
- `cookie_count` (number)
- `cookie_names` (list)
- `countries` (list)
- `domain_count` (number)
- `domains_contacted` (list)
- `error` (text)
- `external_links` (list)
- `final_url` (text)
- `form_count` (number)
- `form_destinations` (list): Where the page's forms send what is typed.
- `hosting_providers` (list)
- `ip_addresses` (list)
- `load_time_seconds` (number)
- `page_size_kb` (number)
- `password_field_count` (number): Password boxes on the page.
- `primary_ip` (text)
- `redirect_count` (number)
- `redirects` (list)
- `report_url` (text)
- `request_count` (number)
- `scan_id` (text)
- `screenshot_url` (text)
- `script_count` (number)
- `script_urls` (list)
- `speed` (text): Such as Very Fast or Slow.
- `status` (text)
- `submitted_at` (text)
- `title` (text): The page title.
- `tracker_count` (number)
- `url` (text)
- `warning_page_detected` (true/false): Whether a browser warning page was shown.

**Example output**

```json
{
  "completed_at": "2026-01-10T19:19:48Z",
  "cookie_count": 4,
  "cookie_names": [
    "oc_sessionPassphrase"
  ],
  "countries": [
    "US"
  ],
  "domain_count": 2,
  "domains_contacted": [
    "cgrgy.pages.dev",
    "mia.nl.tab.digital"
  ],
  "error": null,
  "external_links": [
    "https://a.tab.digital/MItva"
  ],
  "final_url": "https://mia.nl.tab.digital/login",
  "form_count": 1,
  "form_destinations": [
    "https://mia.nl.tab.digital/login"
  ],
  "hosting_providers": [
    "CLOUDFLARENET"
  ],
  "ip_addresses": [
    "172.66.44.235",
    "104.21.3.117"
  ],
  "load_time_seconds": 30.11,
  "page_size_kb": 0.0,
  "password_field_count": 1,
  "primary_ip": "172.66.44.235",
  "redirect_count": 1,
  "redirects": [
    {
      "from_url": "http://cgrgy.pages.dev/",
      "status_code": 307,
      "to_url": "https://cgrgy.pages.dev/"
    }
  ],
  "report_url": "https://scanmalware.com/result/0d403c95-5cd3-48a8-bf28-ab5060df3ac1",
  "request_count": 2,
  "scan_id": "0d403c95-5cd3-48a8-bf28-ab5060df3ac1",
  "screenshot_url": "https://scanmalware.com/api/v1/screenshot/0d403c95-5cd3-48a8-bf28-ab5060df3ac1.png",
  "script_count": 0,
  "script_urls": [],
  "speed": "Slow",
  "status": "completed",
  "submitted_at": "2026-01-10T19:17:02Z",
  "title": "Login \u2013 Nextcloud",
  "tracker_count": 0,
  "url": "http://cgrgy.pages.dev/",
  "warning_page_detected": false
}
```

### Get recent malware detections

List the files ScanMalware's antivirus caught on scanned pages recently, such as trojans offered as downloads, with the threat name and where it was found.

**Inputs**

- Hours to look back (`hours`, number): From 1 to 168 (a week). Defaults to 24. From 1 to 168.
- Most detections (`limit`, number): From 1 to 1000. Defaults to 50. From 1 to 1000.
- Include files too big to check (`include_size_limit_notices`, true/false): The antivirus also reports files it was too big to read. They aren't known to be harmful, so they're left out unless you turn this on. Default: `false`.

**Outputs**

- `detection_count` (number)
- `detections` (list)
- `hours` (number)
- `threat_names` (list)

**Example output**

```json
{
  "detection_count": 1,
  "detections": [
    {
      "detected_at": "2026-10-11T20:12:32Z",
      "file_size_bytes": 558592,
      "file_type": "application/octet-stream",
      "report_url": "https://scanmalware.com/result/4902d2ab-afed-4437-9295-f76198953bf3",
      "scan_id": "4902d2ab-afed-4437-9295-f76198953bf3",
      "threat_name": "Win.Trojan.Havoc-10035024-0",
      "url": "https://ed75a310.infinityindians.pages.dev/ktool.exe"
    }
  ],
  "hours": 24,
  "threat_names": [
    "Win.Trojan.Havoc-10035024-0"
  ]
}
```

### Get scan verdict

Find out whether a scanned page is dangerous and why: the risk verdict and score, the AI's classification and scam type, the evidence, and an is_dangerous flag to branch on. A scan that is still running reports how far along it is instead.

**Inputs**

- Scan ID (`scan_id`, text, required): The scan to read. Scan a website, Search scans and the other lists return it; a scanmalware.com report link works too.

**Outputs**

- `ai_analyzed_at` (text): When the AI looked (UTC).
- `ai_classification` (text): LEGITIMATE, LOW_RISK, MODERATE_RISK, HIGH_RISK, CONFIRMED_SCAM or NOT_ASSESSED.
- `ai_classification_label` (text): The AI classification in plain words.
- `ai_confidence` (number): How sure the AI is, in percent.
- `ai_key_evidence` (list): What the AI based it on.
- `ai_recommended_action` (text): What the AI recommends.
- `ai_risk_score` (number): The AI's risk score from 0 to 10.
- `ai_safety_factors` (list): What speaks for the page.
- `ai_scam_type` (text): The kind of scam, such as Phishing.
- `ai_summary` (text): The AI's one-line verdict.
- `certificate_valid` (true/false): Whether HTTPS was valid.
- `completed_at` (text): When the scan finished (UTC).
- `final_url` (text): Where the page ended up after any redirects.
- `finished` (true/false): Whether the scan has finished.
- `is_dangerous` (true/false): True when the verdict is high risk or worse, or the AI calls it high risk or a confirmed scam.
- `load_time_seconds` (number): How long the page took to load.
- `progress_percent` (number): How far along the scan is.
- `recommendations` (list): What to do about it.
- `redirect_count` (number): How many redirects there were.
- `report_url` (text): The full report on scanmalware.com.
- `risk_factors` (list): Why the page looks risky.
- `risk_level` (text): low, medium, high or malicious.
- `risk_score` (number): Risk score from 0 (safe) to 100.
- `scan_id` (text): The scan's ID.
- `screenshot_url` (text): A screenshot of the page.
- `status` (text): queued, processing, completed or failed.
- `technology_count` (number): How many technologies were found.
- `tracker_count` (number): How many trackers were found.
- `url` (text): The address that was scanned.
- `verdict` (text): ScanMalware's verdict, such as Low Risk or High Risk.

**Example output**

```json
{
  "ai_analyzed_at": "2026-01-10T19:20:18Z",
  "ai_classification": "CONFIRMED_SCAM",
  "ai_classification_label": "Confirmed scam",
  "ai_confidence": 100,
  "ai_key_evidence": [
    "Login form with password field present on the malicious domain"
  ],
  "ai_recommended_action": "Avoid interaction and report as scam",
  "ai_risk_score": 10,
  "ai_safety_factors": [],
  "ai_scam_type": "Phishing",
  "ai_summary": "Confirmed phishing scam harvesting Nextcloud credentials via a malicious domain.",
  "certificate_valid": true,
  "completed_at": "2026-01-10T19:19:48Z",
  "final_url": "https://mia.nl.tab.digital/login",
  "finished": true,
  "is_dangerous": true,
  "load_time_seconds": 30.11,
  "progress_percent": 100,
  "recommendations": [
    "Avoid visiting this website - high security risk detected"
  ],
  "redirect_count": 1,
  "report_url": "https://scanmalware.com/result/0d403c95-5cd3-48a8-bf28-ab5060df3ac1",
  "risk_factors": [
    "Mixed Content",
    "Threat-intel IoC on scanned domain (apt redwolf (malware)): mia.nl.tab.digital"
  ],
  "risk_level": "high",
  "risk_score": 60,
  "scan_id": "0d403c95-5cd3-48a8-bf28-ab5060df3ac1",
  "screenshot_url": "https://scanmalware.com/api/v1/screenshot/0d403c95-5cd3-48a8-bf28-ab5060df3ac1.png",
  "status": "completed",
  "technology_count": 2,
  "tracker_count": 0,
  "url": "http://cgrgy.pages.dev/",
  "verdict": "High Risk"
}
```

### Get site certificate

Read the HTTPS certificate a scanned site presented: who it was issued to and by, when it expires, the names it covers, and whether it is valid, expired or self-signed.

**Inputs**

- Scan ID (`scan_id`, text, required): The scan to read. Scan a website, Search scans and the other lists return it; a scanmalware.com report link works too.

**Outputs**

- `days_until_expiry` (number)
- `fingerprint_sha256` (text)
- `is_expired` (true/false)
- `is_lets_encrypt` (true/false)
- `is_self_signed` (true/false)
- `is_valid` (true/false)
- `is_wildcard` (true/false)
- `issued_to` (text): The site name on it.
- `issuer` (text)
- `issuer_organization` (text)
- `key_algorithm` (text)
- `key_size` (number)
- `names_covered` (list)
- `organization` (text)
- `report_url` (text)
- `scan_id` (text)
- `serial_number` (text)
- `signature_algorithm` (text)
- `valid_from` (text)
- `valid_until` (text)

**Example output**

```json
{
  "days_until_expiry": 71,
  "fingerprint_sha256": "85ca6ab068e9bcce88b6c4aa3c47f7d17228134a457f870d3800e6223a0df07a",
  "is_expired": false,
  "is_lets_encrypt": false,
  "is_self_signed": false,
  "is_valid": true,
  "is_wildcard": true,
  "issued_to": "example.com",
  "issuer": "Cloudflare TLS Issuing ECC CA 3",
  "issuer_organization": "SSL Corporation",
  "key_algorithm": "ECDSA",
  "key_size": 256,
  "names_covered": [
    "example.com",
    "*.example.com"
  ],
  "organization": null,
  "report_url": "https://scanmalware.com/result/461657ef-5829-435e-a0fc-ffad90e8fcbc",
  "scan_id": "461657ef-5829-435e-a0fc-ffad90e8fcbc",
  "serial_number": "2569673129085639595562975411803018896",
  "signature_algorithm": "ecdsa-with-SHA256",
  "valid_from": "2026-09-26T22:49:11Z",
  "valid_until": "2026-12-25T22:56:35Z"
}
```

### Get site technologies

List the software a scanned site runs on, such as WordPress, Cloudflare or jQuery, with versions where they could be told.

**Inputs**

- Scan ID (`scan_id`, text, required): The scan to read. Scan a website, Search scans and the other lists return it; a scanmalware.com report link works too.

**Outputs**

- `scan_id` (text)
- `technologies` (list)
- `technology_count` (number)
- `technology_names` (list)

**Example output**

```json
{
  "scan_id": "461657ef-5829-435e-a0fc-ffad90e8fcbc",
  "technologies": [
    {
      "confidence": 40,
      "name": "Cloudflare",
      "version": null,
      "website": null
    },
    {
      "confidence": 40,
      "name": "HTTP/3",
      "version": null,
      "website": null
    }
  ],
  "technology_count": 2,
  "technology_names": [
    "Cloudflare",
    "HTTP/3"
  ]
}
```

### Get sites impersonating a brand

List the sites caught pretending to be a brand, such as fake PayPal or Microsoft logins, most recently seen first, with each one's verdict and a link to its report.

**Inputs**

- Brand (`brand`, text, required): The brand to check, most impersonated first. You can also type its short name, such as paypal.
- Number of sites (`limit`, number): From 1 to 1000. Defaults to 25. From 1 to 1000.

**Outputs**

- `brand` (text)
- `brand_name` (text)
- `last_seen` (text)
- `official_domains` (list)
- `sector` (text)
- `sighting_count` (number)
- `sightings` (list)
- `total_hosts` (number): How many different fake sites were caught.
- `total_sightings` (number)

**Example output**

```json
{
  "brand": "paypal",
  "brand_name": "PayPal",
  "last_seen": "2026-10-15",
  "official_domains": [
    "paypal.com",
    "paypalobjects.com"
  ],
  "sector": "payment",
  "sighting_count": 1,
  "sightings": [
    {
      "ai_classification": "CONFIRMED_SCAM",
      "ai_risk_score": 9,
      "first_seen": "2026-08-23T00:47:04Z",
      "host": "pay-pal-omega.vercel.app",
      "last_seen": "2026-10-15T00:47:37Z",
      "report_url": "https://scanmalware.com/result/372188eb-447b-42a0-863b-fd6e8b955f1d",
      "risk_level": "malicious",
      "risk_score": 80,
      "scan_id": "372188eb-447b-42a0-863b-fd6e8b955f1d",
      "times_seen": 12,
      "title": "Log in to your PayPal account",
      "verdict": "Malicious"
    }
  ],
  "total_hosts": 34,
  "total_sightings": 102
}
```

### List impersonated brands

List the brands ScanMalware watches for look-alike sites, with how many fake sites have been caught for each. Filter by name or industry.

**Inputs**

- Brand name (`search`, text): Only brands whose name or website contains this.
- Industry (`sector`, text): Only brands in this industry.
- Only brands with fake sites (`only_impersonated`, true/false): Leave out brands no fake site has been caught for yet. Default: `false`.
- Sort by (`sort`, text): Which brands come first. Defaults to most sightings. One of: `sightings` (Most sightings), `hosts` (Most fake sites), `recent` (Most recently seen), `name` (Name A to Z). Default: `sightings`.
- Number of brands (`limit`, number): From 1 to 1000. Defaults to 50. From 1 to 1000.

**Outputs**

- `brand_count` (number)
- `brands` (list)
- `total_brands` (number)

**Example output**

```json
{
  "brand_count": 1,
  "brands": [
    {
      "brand": "paypal",
      "homepage_url": "https://paypal.com",
      "impersonating_sites": 34,
      "last_seen": "2026-10-15",
      "name": "PayPal",
      "official_domains": [
        "paypal.com",
        "paypalobjects.com"
      ],
      "sector": "payment",
      "sightings": 102
    }
  ],
  "total_brands": 11
}
```

### List recent scans

List the newest public scans anyone has run on ScanMalware, newest first, with links to each report.

**Inputs**

- Number of scans (`limit`, number): How many scans to return, from 1 to 100. Defaults to 20. From 1 to 100.
- Page (`page`, number): Which page of results to return. Defaults to 1. From 1 to 10000.

**Outputs**

- `has_more` (true/false): Whether there is another page.
- `page` (number)
- `scan_count` (number): How many scans are in this list.
- `scans` (list)
- `total_scans` (number): How many scans match in all.

**Example output**

```json
{
  "has_more": true,
  "page": 1,
  "scan_count": 1,
  "scans": [
    {
      "completed_at": "2026-10-15T18:02:45Z",
      "countries": [
        "US"
      ],
      "final_url": "https://example.com/",
      "hosting_providers": [
        "Cloudflare, Inc."
      ],
      "load_time_seconds": 0.2,
      "report_url": "https://scanmalware.com/result/461657ef-5829-435e-a0fc-ffad90e8fcbc",
      "scan_id": "461657ef-5829-435e-a0fc-ffad90e8fcbc",
      "screenshot_url": "https://scanmalware.com/api/v1/screenshot/461657ef-5829-435e-a0fc-ffad90e8fcbc.png",
      "status": "completed",
      "submitted_at": "2026-10-15T18:02:13Z",
      "title": "Example Domain",
      "url": "https://example.com",
      "visibility": "public"
    }
  ],
  "total_scans": 705223
}
```

### Scan a website

Open a web address in ScanMalware's browser and check it for phishing, scams and malware. By default the step waits for the result, usually 20 to 60 seconds, and returns the verdict, an is_dangerous flag to branch on and a link to the full report. Set the wait to 0 to get the scan ID back at once and read the verdict later with Get scan verdict.

**Inputs**

- Web address (`url`, text, required): The page to scan. A bare domain such as example.com works too. Only scan addresses you're allowed to check.
- Who can see it (`visibility`, text): Public scans appear in ScanMalware's listings and search. Unlisted scans stay out of them, but anyone with the scan ID or link can still open them. One of: `public`, `unlisted`. Default: `public`.
- Wait for the result (seconds) (`wait_seconds`, number): How long to wait for the scan to finish, from 0 to 300. Defaults to 120. Use 0 to return straight away. From 0 to 300. Default: `120`.

**Outputs**

- `ai_analyzed_at` (text): When the AI looked (UTC).
- `ai_classification` (text): LEGITIMATE, LOW_RISK, MODERATE_RISK, HIGH_RISK, CONFIRMED_SCAM or NOT_ASSESSED.
- `ai_classification_label` (text): The AI classification in plain words.
- `ai_confidence` (number): How sure the AI is, in percent.
- `ai_key_evidence` (list): What the AI based it on.
- `ai_recommended_action` (text): What the AI recommends.
- `ai_risk_score` (number): The AI's risk score from 0 to 10.
- `ai_safety_factors` (list): What speaks for the page.
- `ai_scam_type` (text): The kind of scam, such as Phishing.
- `ai_summary` (text): The AI's one-line verdict.
- `certificate_valid` (true/false): Whether HTTPS was valid.
- `completed_at` (text): When the scan finished (UTC).
- `error` (text): Why the scan failed, if it did.
- `final_url` (text): Where the page ended up after any redirects.
- `finished` (true/false): Whether the scan has finished.
- `is_dangerous` (true/false): True when the verdict is high risk or worse, or the AI calls it high risk or a confirmed scam.
- `load_time_seconds` (number): How long the page took to load.
- `progress_percent` (number): How far along the scan is.
- `recommendations` (list): What to do about it.
- `redirect_count` (number): How many redirects there were.
- `report_url` (text): The full report on scanmalware.com.
- `risk_factors` (list): Why the page looks risky.
- `risk_level` (text): low, medium, high or malicious.
- `risk_score` (number): Risk score from 0 (safe) to 100.
- `scan_id` (text): The scan's ID.
- `screenshot_url` (text): A screenshot of the page.
- `status` (text): queued, processing, completed or failed.
- `submitted_at` (text): When the scan was started (UTC).
- `technology_count` (number): How many technologies were found.
- `tracker_count` (number): How many trackers were found.
- `url` (text): The address that was scanned.
- `verdict` (text): ScanMalware's verdict, such as Low Risk or High Risk.
- `visibility` (text): public or unlisted.

**Example output**

```json
{
  "ai_analyzed_at": "2026-10-15T18:03:03Z",
  "ai_classification": "LEGITIMATE",
  "ai_classification_label": "Legitimate",
  "ai_confidence": 95,
  "ai_key_evidence": [
    "Domain ranked #7,087 in Cisco Umbrella"
  ],
  "ai_recommended_action": "Safe to use",
  "ai_risk_score": 0,
  "ai_safety_factors": [
    "No forms or interactive credential elements"
  ],
  "ai_scam_type": null,
  "ai_summary": "Low-risk scan on a well-ranked domain.",
  "certificate_valid": true,
  "completed_at": "2026-10-15T18:02:45Z",
  "error": null,
  "final_url": "https://example.com/",
  "finished": true,
  "is_dangerous": false,
  "load_time_seconds": 0.2,
  "progress_percent": 100,
  "recommendations": [],
  "redirect_count": 0,
  "report_url": "https://scanmalware.com/result/461657ef-5829-435e-a0fc-ffad90e8fcbc",
  "risk_factors": [],
  "risk_level": "low",
  "risk_score": 23,
  "scan_id": "461657ef-5829-435e-a0fc-ffad90e8fcbc",
  "screenshot_url": "https://scanmalware.com/api/v1/screenshot/461657ef-5829-435e-a0fc-ffad90e8fcbc.png",
  "status": "completed",
  "submitted_at": "2026-10-15T18:02:13Z",
  "technology_count": 3,
  "tracker_count": 0,
  "url": "https://example.com",
  "verdict": "Low Risk",
  "visibility": "public"
}
```

### Search scans

Search every public scan by words in the address or title, or with filters such as domain:paypal.com, ip:1.2.3.4, country:RU or technology:WordPress. Combine them with AND, OR and NOT.

**Inputs**

- Search for (`query`, text, required): Words, filters or both. The full list of filters is at https://scanmalware.com/api-docs.
- Sort by (`sort`, text): Which scans come first. Defaults to newest. One of: `newest` (Newest first), `oldest` (Oldest first), `url` (Address A to Z), `load_time` (Slowest to load), `ip_count` (Most IP addresses). Default: `newest`.
- Number of scans (`limit`, number): How many scans to return, from 1 to 100. Defaults to 20. From 1 to 100.
- Page (`page`, number): Which page of results to return. Defaults to 1. From 1 to 1000.

**Outputs**

- `has_more` (true/false): Whether there is another page.
- `page` (number)
- `query` (text)
- `scan_count` (number): How many scans are in this list.
- `scans` (list)
- `total_scans` (number): How many scans match in all.

**Example output**

```json
{
  "has_more": true,
  "page": 1,
  "query": "domain:example.com",
  "scan_count": 1,
  "scans": [
    {
      "completed_at": "2026-10-15T18:02:45Z",
      "countries": [
        "US"
      ],
      "final_url": "https://example.com/",
      "hosting_providers": [
        "Cloudflare, Inc."
      ],
      "load_time_seconds": 0.2,
      "report_url": "https://scanmalware.com/result/461657ef-5829-435e-a0fc-ffad90e8fcbc",
      "scan_id": "461657ef-5829-435e-a0fc-ffad90e8fcbc",
      "screenshot_url": "https://scanmalware.com/api/v1/screenshot/461657ef-5829-435e-a0fc-ffad90e8fcbc.png",
      "status": "completed",
      "submitted_at": "2026-10-15T18:02:13Z",
      "title": "Example Domain",
      "url": "https://example.com",
      "visibility": "public"
    }
  ],
  "total_scans": 513
}
```