URLScan.io

Overview

urlscan.io scans websites in a headless browser and returns the full picture — requests, resources, certificates, and verdicts. Public scan search works without a key (verified live — search results return 200 anonymously); submitting new scans and richer queries need a free API key.

Quick Start

Search public scans — no key needed (verified live):

curl "https://urlscan.io/api/v1/search/?q=domain:example.com&size=3"

{
  "total": 12345,
  "results": [
    {
      "task": { "url": "example.com", "visibility": "public", "method": "api" },
      "page": { "url": "https://example.com", "status": 200 },
      "result": { "verdicts": { "overall": { "malicious": false } } },
      "stats": { "requests": 45 }
    }
  ]
}

Submit a scan (with an API key):

curl -X POST "https://urlscan.io/api/v1/scan/" \
  -H "Content-Type: application/json" \
  -H "API-Key: YOUR_KEY" \
  -d '{"url": "https://example.com", "visibility": "public"}'

Get a scan result by UUID:

curl "https://urlscan.io/api/v1/result/YOUR_UUID/"

Authentication

• Anonymous: search/lookup of public scans works keyless (verified).
• API key (free at urlscan.io): submit scans, higher limits, private scans.

Rate Limits & Notes

• Free key: ~50 public scans/day and 20/min search — modest; paid tiers scale.
• Search supports urlscan’s query syntax (domain:, ip:, filename:, country:…).
• Results include verdicts (malicious/benign heuristics), stats (requests, sizes), and page metadata.
• Scan submissions are async — poll the result endpoint until it’s ready.

FAQ

Is urlscan.io free? Yes — search is keyless; a free key enables submissions and higher limits.

Do I need a key to search? No — public scan search works anonymously (verified).

What does a result include? All requests made, page resources, certificates, and a malicious/benign verdict.