greatapis

Anti-Malware — entry 013 of 15

URLScan.io

Verified Jul 2026

urlscan.io submits URLs to a real, sandboxed browser and publishes the resulting screenshot, DOM, requested domains, and detected technologies, plus a searchable archive of past scans, all as JSON. A live unauthenticated GET against its search endpoint succeeded immediately (returning IP-scoped X-Rate-Limit headers), and a follow-up OPTIONS preflight returned Access-Control-Allow-Origin: *, resolving cors to yes and confirming HTTPS; submitting new scans instead requires an API-Key header. Public scanning is free within per-minute/hour/day rate limits, with a paid urlscan Pro tier for vetted researchers needing deeper private search.

url-scanningthreat-intelligencesandboxsecurityapi-key
Visit urlscan.io ↗More Anti-Malware
AuthenticationAPI KeySign up with the provider to obtain credentials.
HTTPSSupportedTraffic is encrypted in transit.
CORSEnabledCallable directly from browser JavaScript.
PricingFreemiumA usable free tier exists, with paid plans for more volume.
FormatsJSONResponses can be requested as JSON.

GreatAPIs Score

Score61out of 100
Authentication15/25API key required
Pricing17/20Freemium tier available
Docs0/20No docs or spec available
Formats9/15Single response format
Freshness20/20Verified within 6 months

Embed this badge

Scored 61 on greatapis.com
<a href="https://greatapis.com/api/urlscan-io/"><img src="https://greatapis.com/badge/urlscan-io.svg" alt="Scored 61 on greatapis.com"></a>

Auth quickstart

  1. Sign up with the provider to get an API key.
  2. Send it on every request as a headerAuthorization: <key>
  3. The exact header isn't documented — Authorization is a common default; confirm in the provider's docs.
Stored keyNo key stored

Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.

People comparing URLScan.io also look at…

All 15 →

URLScan.io vs AlienVault Open Threat Exchange (OTX)

Open Threat Exchange is AT&T Cybersecurity's community threat-intelligence platform, now operated under the LevelBlue brand, where contributors publish "pulses" of malicious IPs, domains, hashes, and URLs that anyone can query. A live, unauthenticated GET against its IPv4 general-info endpoint returned a full 200 JSON response, and both that call and its OPTIONS preflight echoed the request's Origin in Access-Control-Allow-Origin, resolving cors to yes; an OTX-API-KEY is still needed for higher rate limits and pulse subscriptions. Signup, the API key, and the community feed itself are all free.

Compare →

URLScan.io vs CAPEsandbox

URLScan.io supports CORS, while CAPEsandbox doesn't — pick URLScan.io for direct browser calls.

Compare →

URLScan.io vs Google Safe Browsing

Google Safe Browsing lets clients check URLs against Google's continuously updated lists of malware, phishing, and unwanted-software sites via the v4 threatMatches:find endpoint, the same data that powers warnings in Chrome and Search. A live POST with a syntactically valid but bogus key returned a 400 "API key not valid" error from safebrowsing.googleapis.com, reconfirming API-key auth and HTTPS, and both that call and its OPTIONS preflight echoed the request Origin in Access-Control-Allow-Origin. The API is free for any Google Cloud project under its published quota.

Compare →

URLScan.io vs MalShare

URLScan.io supports CORS, while MalShare doesn't — pick URLScan.io for direct browser calls.

Compare →

URLScan.io vs MalDatabase

URLScan.io supports CORS, while MalDatabase doesn't — pick URLScan.io for direct browser calls.

Compare →

URLScan.io vs NoPhishy

NoPhishy (listed on RapidAPI as Exerra Phishing Check) queries a maintained database of 299,000+ known phishing domains, refreshed roughly every two hours, to flag whether a submitted URL or domain is a known phishing attempt. A live GET through the real RapidAPI gateway host with an invalid x-rapidapi-key returned a 403 rejection rather than a network-level block, reconfirming API-key auth over HTTPS, and Access-Control-Allow-Origin echoed the request's Origin on that same call. Like other RapidAPI-distributed APIs it offers a free Basic plan alongside paid tiers for higher request volumes.

Compare →

Scanii

Simple REST API that can scan submitted documents/files for the presence of threats

Basic Auth · CORS

AbuseIPDB

IP/domain/URL reputation

API Key

MalwareBazaar

Collect and share malware samples

API Key

URLhaus

Bulk queries and Download Malware Samples

API Key

VirusTotal

VirusTotal File/URL Analysis

API Key

Web of Trust

IP/domain/URL reputation

API Key · CORS