About ScanMalware Security Scanner
A URL security scanner that visits a site the way a browser does, records what it actually loads and runs, and turns that into an evidence-backed verdict.
A typical scan records around 6,200 data points, from the screenshot and page text to certificates, scripts, network traffic and domain registration.
Our Story
ScanMalware was founded in July 2025 by Jonas Lejon, a Swedish cybersecurity specialist, and is operated by Triop AB. The idea was simple: when a link looks suspicious, open it somewhere safe, record everything the page loads and runs, and show the evidence behind the verdict instead of a bare score.
The first version of the scanner was running by the end of August 2025. Since then it has grown one capability at a time, often because a real campaign showed what was missing: a new kind of fake CAPTCHA, a phishing kit hiding behind a bot check, or a lure that tells Mac users to paste a command into Terminal.
Today it is built into tools that security teams already use, including Microsoft’s msticpy, ProjectDiscovery’s subfinder, MISP, OpenCTI and TheHive’s Cortex. Scanning is still free, and it still needs no account.
Milestones
- July 2025ScanMalware is founded
- August 2025The first version of the scanner runs end to end
- Autumn 2025JavaScript fingerprinting, TLS certificate analysis and Certificate Transparency lookups
- January 2026An MCP server lets AI assistants submit scans and read results
- March 2026Advanced Search, with a query language for pivoting across every public scan
- July 2026Detection of ClickFix pages that trick visitors into pasting a command
- August–September 2026Built into subfinder, msticpy, MISP, OpenCTI and other security tools
- October 2026Analysis of the WebAssembly modules a page loads
Detection Scale
What a scan is matched against: indicator feeds, detection rules and virus signatures, refreshed daily — last updated 2026-10-17.
What We Do
Security Analysis
Detect malware, phishing pages, scams and suspicious scripts, and explain the reasoning behind each verdict with the evidence it rests on. Anyone can flag a verdict that looks wrong, and those reports are read.
Technology Detection
Identify the frameworks, libraries and services a site is built on, and check the JavaScript library versions it loads against known vulnerabilities.
Visual Analysis
Capture screenshots and compare them against everything scanned before, to surface fake sign-in pages, cloned layouts and deceptive content.
Network Monitoring
Record every request and WebSocket connection a page makes while loading, any file it makes the browser download and any dialog or window it opens by itself, and flag connections to known malicious domains, addresses and infrastructure.
Analysis Modules
AI-Powered Security Analysis
AI models review the collected scan evidence and produce a security assessment alongside the rule-based verdict, classifying phishing, scams and malware delivery with the findings that support the rating.
Multi-Layer Threat Intelligence
Domains, addresses, URLs and file hashes seen during a scan are matched against a large aggregated indicator set, combined with Google Safe Browsing and Cisco Umbrella domain rankings. Each match names the source and where it was seen.
Malware & Phishing Kit Rule Matching
Page content, scripts and downloaded files are matched against YARA rules and antivirus signatures to identify malware families, known phishing kits and the infrastructure behind them.
Credential & Form Analysis
Deep inspection of web forms to detect credential harvesting, payment card skimming and other suspicious data collection, including where a form actually sends what a visitor types.
Clipboard Hijacking & Fake Fix Pages
Catches pages that quietly place a command on your clipboard and then talk you into running it — the fake CAPTCHA, “verify you are human”, “fix this error” and fake browser-update pages behind a growing share of malware infections, on Windows and on Mac. The command that was planted is captured and shown in full. Also covers ConsentFix lures, which start a genuine sign-in and ask you to paste the result back, handing over your account without a password.
JavaScript Obfuscation & Behaviour Analysis
Reports how heavily a page's JavaScript is obfuscated and what it does at runtime — dynamic code execution, suspicious API use — and shows the code that triggered each finding, per script and across the whole page.
WebAssembly Analysis
Every WebAssembly module a page loads is taken apart and described in plain words: how it reached the page, the language and tools it was built with, the known libraries and services inside it, and what it did when run in isolation. Each module gets its own page listing the public scans it appeared on, and can be downloaded.
Browser Feature Use
Lists the browser features a page actually used while loading, such as camera, microphone or location requests, clipboard access, fullscreen and WebAssembly. They are recorded by the browser itself, so obfuscated code cannot hide them.
Visual Similarity & Text Extraction
Perceptual hashing matches a screenshot against visually similar pages across every scan on record, and multi-language OCR extracts on-page text from images so lures and phishing wording are analysed even when rendered as graphics.
Content & Code Similarity
Fuzzy hashing with TLSH and ssdeep detects malware variants and content clones despite minor edits, and matches a script against a library of known-good releases so an altered copy of a common library stands out.
Brand Impersonation Detection
Identifies pages presenting themselves as a brand they do not belong to, using page content, favicons, layout and domain signals rather than the site's own claims about its identity.
Tracker & Privacy Analysis
Identifies analytics, advertising and tracking services embedded in a page, including fingerprinting scripts and other privacy-invasive technologies.
Technology Stack Detection
Fingerprinting identifies the technologies, frameworks and CMS platforms behind a site and records each one as a standard CPE identifier, and the JavaScript libraries a page loads are checked against known vulnerabilities for the exact version.
Bot Protection & Anti-Analysis Detection
Detects when a site is behind a bot-protection or challenge service, and when a page behaves differently for visitors it believes are being analysed.
TLS Certificate Analysis
Each certificate is checked and scored: issuer and chain, how long it is valid for, weak keys and deprecated signature algorithms, hostname mismatches, and whether the domain's own DNS policy permits the authority that issued it. JARM, JA4S and JA4X fingerprints of each server and certificate link sites that run on the same setup.
Certificate Transparency Intelligence
Certificate Transparency log monitoring surfaces lookalike domains, typosquatting attempts and wildcard certificates, helping identify phishing infrastructure and domain impersonation as it is set up.
RDAP/WHOIS Domain Intelligence
RDAP with WHOIS fallback for domain registration data, including domain age for risk assessment and dedicated handling of newly registered domains, which are heavily used in phishing campaigns. Includes network information from the Regional Internet Registries.
Network Intrusion Detection
Captured network traffic is analysed for malicious activity patterns, exploit attempts and suspicious communications, using intrusion-detection rules applied to the recorded PCAP data.
Research Tools
Threat Hunts
Write a query against everything we have scanned and keep it running, so new matches surface as they appear rather than only when you go looking.
Cross-Scan Search & Query Language
Pivot across the whole corpus by domain, URL, screenshot, file or script hash, script behaviour, technology, network or tracking identifier — in plain search, or with a structured query language of more than 150 filters you can combine. A Breakdown view shows what the results have in common — hosting networks, registrars, certificates, technologies — with one click to narrow or exclude.
Brand Pages
Browse impersonation activity by the brand being targeted, and follow it through to the individual scans behind it.
API, MCP Server & CLI
Submit scans and read results programmatically over the public API, from the command line, or directly from an AI assistant through our MCP server. It is listed in Claude’s connector directory, and a plugin adds it to Claude Code, Codex and Gemini CLI. No key is needed to read; a key raises your limits and ties scans to your account.
Similar Pages & Plain-Language Search
Describe what you are looking for in ordinary words, or start from one scan and find the pages that look like it — the way a kit reused across hundreds of domains shows itself.
Pivots on Every Scan
The Pivot tab on a scan lists every value you can search by — screenshot, favicon and file hashes, analytics and advertising IDs, contacted hosts, server addresses, certificates, cookies, YARA rules — with how many other public scans share each one. Tick several to find the scans that share them all.
Subdomain & Host Discovery
Every hostname a page contacted, declared or merely referenced is recorded and kept apart, because what a page actually talked to is evidence and what it merely mentions is not. Several well-known recon tools read this as a source.
IP, Nameserver & Domain Pages
See every domain seen on an IP address or using a nameserver, with first and last seen dates, network pages with routing details, and a domain search that lists matching domains, including ones never scanned.
Statistics
The networks, hosting platforms, domains and countries behind the most malicious sites, the most common threat types, JavaScript libraries and server fingerprints, from the last twelve hours to the last thirty days.
Per-Script Pages
Any script found on a page gets its own page: full source, what it does at runtime, the library and version it claims to be, and every other site serving it.
Accounts & Private Scans
Scanning needs no account. With one you get your scan history, API keys, and the choice to keep a scan unlisted or private instead of public.
Evidence You Can Take Away
Screenshots, the decrypted network capture and WebAssembly modules can be downloaded, and every script's full source is on its own page, so a finding can be checked, kept or handed on without trusting our summary of it.
Algorithms & Techniques
Machine Learning & AI
- • AI security assessment models
- • Multi-language OCR engine
- • Automated language detection
- • Content classification
Security Algorithms
- • TLSH fuzzy hashing
- • ssdeep similarity detection
- • Perceptual image hashing
- • JARM, JA4S & JA4X TLS fingerprinting
- • SHA256 & MD5 hashing
Analysis Techniques
- • DOM tree analysis
- • JavaScript behaviour monitoring
- • WebAssembly module analysis
- • Browser API use recording
- • Clipboard & pastejacking monitoring
- • Network traffic inspection
- • Form field pattern matching
- • Redirect chain reconstruction
- • Certificate Transparency monitoring
- • RPKI BGP origin validation & routing prefixes
- • Domain age risk scoring
- • Device-code & ConsentFix phishing detection
Use Cases
Security Research
Analyze suspicious URLs, investigate phishing campaigns, and research malware distribution networks.
Threat Intelligence
Gather intelligence on emerging threats, monitor malicious infrastructure, and track threat actor activities.
Website Analysis
Perform technical analysis of websites, identify technologies used, and assess security posture.
Educational Purposes
Learn about web security, understand how malicious websites work, and practice security analysis skills.
Integrations
ScanMalware is built into these third-party security tools as a native source, with no plugin to sideload. Open-source integrations are merged upstream and installable today; commercial ones ship in the product itself.
msticpy
Microsoft’s Python toolkit for security investigation and threat hunting. Since v3.1.0 ScanMalware is a threat-intelligence provider, so a notebook can look up a domain, hostname, URL or IP against the scan archive without an API key.
subfinder
A passive source for subdomain enumeration, in ProjectDiscovery’s default source set since v2.16.0. Hostnames we have observed in the wild feed straight into recon.
OpenCTI
Two connectors. An enrichment connector scans an observable on demand and writes the verdict and its evidence back to the platform; an import connector pulls the public scan feed in as indicators. Also listed on Filigran's XTM Hub.
MISP
MISP is the open-source threat intelligence platform that CERTs, SOCs and ISACs use to store, correlate and share indicators. Our expansion module ships with misp-modules: a domain or hostname gains the subdomains seen in Certificate Transparency and the hosts a browser actually contacted while rendering it; a URL gains its latest sandboxed scan, verdict and report link; an IP gains the scanned URLs that resolved to it. No API key needed.
TheHive
TheHive is the incident-response platform where SOC and CERT analysts work their cases, and Cortex is its analysis engine, which runs analyzers over the observables in a case. Since Cortex-Analyzers 3.10.1 our analyzer looks up a domain, hostname, URL or IP in the scan archive and reports its scan statistics, the scans it appeared in and the scanner’s verdict. No API key needed.
CapLoader
The network analysis tool from Netresec, built for searching and sorting large packet captures. Its OSINT lookups can query ScanMalware for an IP address or domain seen in a capture, so the endpoints of a suspicious flow can be checked without leaving the investigation.
OpenConnector
OOMOL’s open-source connector gateway, which gives AI agents one set of actions across the services they use, over MCP, HTTP or a command line. ScanMalware is one of its providers and needs no API key: an agent can submit a URL for scanning, read a scan’s summary, search the archive, and list a domain’s scans and DNS history.
osmedeus
A security orchestration engine that runs reconnaissance and vulnerability-scanning workflows written in YAML. Since v5.1.2 it installs subfinder v2.16.0, and its subdomain-enumeration workflows run subfinder with its default sources, so they query ScanMalware with no configuration and no API key.
VulnClaw
An AI penetration-testing agent that ships ScanMalware as a built-in MCP server since v0.4.0. It is off by default, because lookups leave the operator’s machine; one setting gives the agent scan verdicts, Certificate Transparency and infrastructure pivots.
cyberbro
Checks one observable against many reputation services at once. Since v0.15.0 ScanMalware is one of the engines you can select, beside VirusTotal, urlscan and Shodan, and it needs no API key for domains, URLs and IPs.
checkip
A command-line tool that gathers information about an IP address. Since v0.55.0 it runs a ScanMalware check that reports the scans in which a page contacted the address and the URLs hosted on it, with no API key.
subfaster
Carries the same source in its curated fast set, so a default run queries the archive without any configuration.
Building your own? The API is anonymous and needs no key, see the API documentation.
Important Notice
ScanMalware is for defensive, investigative and educational use. A scan visits a page the way an ordinary visitor would and records what it serves — it does not attack, log in, or try to break anything. Do not use it to attack a site, to overwhelm one with automated scans, or to publish private material that a scan happens to capture. Public scans are visible to everyone, so use a private scan for anything sensitive.