Changelog

Advanced search can now find a cryptocurrency wallet or contract address anywhere in a page's scripts with the new script_address filter, whether the script spells it out or hides it until decoded, so pages carrying the same loader contract on different sites can be found together. Addresses written in plain text also appear in the Pivot tab and the pivot graph.

Scans can now be linked by the contact details a page links to (phone numbers, email addresses, WhatsApp numbers, Telegram channels and invites, Discord invites) and by the site a page names as its own address in its og:url tag, which a copied page often keeps from the original. They appear in the Pivot tab and the pivot graph, and in advanced search as the new phone, email, whatsapp, telegram_link, discord_invite and og_host filters. 'Scripts with a similar structure' now only finds scripts that also share code.

Scans can now be linked by the mailbox their DMARC reports go to: reporting services give each account its own mailbox, so one mailbox on several sites usually means one owner. It appears in the Pivot tab and the pivot graph, and in advanced search as the new dmarc_report filter.

Scan results show the scanned site's DNS records, as looked up when the scan ran, in a new DNS tab under Domain & IP Information: addresses, CNAME chain, mail servers, nameservers, TXT, SOA and CAA records, reverse DNS, and a summary of its mail setup (SPF, DMARC, null MX). The Pivot tab and the pivot graph can link scans by mail server, nameserver, CNAME target, SPF include and site-verification token.

The Scripts tab of a fresh scan now shows when script analysis is still running, with placeholders that fill in by themselves as library names, hashes and deobfuscation results arrive - no reload needed.

WebAssembly module pages now show the names a module came with: its own name, the package it was loaded with, where it came from and its file name - Browse /wasm/d779f39f75b96752a33deca9289c2d83754a1c7da21bc88605e2c084f87da771

Scans now record the scanned site's DNS records when the scan runs - addresses, CNAME chain, mail servers, nameservers, TXT, SPF, DMARC and reverse DNS - and keep their history. Search them in advanced search with the new dns_ filters (dns_ip:, dns_cname:, dns_mx:, dns_txt:, spf_include:, dns_verification:, dns_soa:, dns_ptr:, dns_status:) and checks such as has:spf, has:dmarc and has:dns_wildcard, or look up a name, an address or a mail server in the new DNS history API.

Improved WebAssembly capture - scans now record more of the WebAssembly modules that pages build and run in the browser.

WebAssembly module pages now show the file's own layout - each section with its size, memory and table limits, custom sections and build metadata - and the text a module produced when it ran - Browse /wasm/4fb01b1895e824517bdea6adad1fbb4c061226ad4773f0e925b0097c1ddddb59

Unlisted and private scans now show their TLS fingerprints, RPKI check, detected technologies and the other security sections.

When a page could not be loaded, its scan result now still shows what the site's server revealed: the TLS certificate, the TLS fingerprints (JARM and JA4S), the domain registration, the RPKI check of its network and any threat-intelligence matches for the domain or its IP address.

More WebAssembly modules are named: PDF viewers (PDFium and Adobe's PDF engine with its text recognition), machine-learning runtimes (ONNX Runtime, Google MediaPipe), PostgreSQL running in the browser, HEIC and JPEG 2000 image decoders, Bitwarden's password-manager SDK, Pagefind site search and others - Browse /wasm/4fb01b1895e824517bdea6adad1fbb4c061226ad4773f0e925b0097c1ddddb59

Scan results name JavaScript libraries more accurately, and the check for vulnerable library versions uses current vulnerability data covering more libraries.

IP address pages load faster, and search and scan result pages are more reliable.

Velociraptor, the open-source digital forensics and incident response tool, now has a ScanMalware artifact in its Artifact Exchange: from a server notebook, look up a domain, hostname or URL and get the verdict of a scan of that exact host or URL, with no API key - Visit /about

Improved accuracy of the first-seen and last-seen times in certificate-based DNS history and IP-to-domain lookups - Visit /api-docs

Searching scripts by behavioral code hash is much faster, also for code shared by hundreds of thousands of scripts.

Scan results now list every file a page made the browser download, with each file's analysis result, not only the malicious ones.

Sign in with Google, GitHub or Microsoft: create an account or sign in with one click, link or remove these accounts on your account page, and the sign-in page remembers how you signed in last. If you have set up a passkey or an authenticator app, it is still asked - Visit /account

New Privacy Policy and Terms of Service: what we collect and why, who receives it, how long we keep it, your rights under the GDPR, and analytics without cookies - Visit /privacy

Much higher API rate limits: 12,000 requests a minute without an API key and 24,000 with one, so subdomain tools and other integrations get every answer, even on large runs - Visit /api-docs

Domain search now searches all stored certificate logs, with a progress bar while a long search runs - Visit /search-domains

Improved Domain search reliability: wildcard searches of certificate names now run to the end, with a progress notice while they finish - Visit /search-domains

On script pages, the Similar Scripts tab now shows how much code each similar script shares with the one you are viewing and hides scripts that are only built alike, and the new search filter similar_code: finds scripts that share code with a given one - Visit /search-advanced

ScanMalware is now listed in ChatGPT's plugin directory, so ChatGPT can submit scans, search the archive and pivot from one phishing page to the rest of its campaign through our MCP server - Visit /about

Scan results can now be searched by the command a page put on your clipboard, the sites that command downloads from, and the files a page made your browser download, on the Pivot tab and in the pivot graph, where large graphs now group sites that share a value into labelled boxes - Visit /graph

On scan results, the Pivot tab can now search by a page's URL path, find scripts with a similar structure and pivot on the brand a page impersonates. The pivot graph uses every value the Pivot tab shows, leaves out values only one site has, draws each shared file once, and labels the values that link the most sites - Visit /graph

Scan results recognise 88 more kinds of account IDs that sites embed for services such as error tracking, web fonts, chat and reviews, on new scans and on a year of earlier ones, so more sites run by the same people are one search away - Visit /tracking-search

When a page could not be scanned, the result page now shows one notice with the reason, still lists the site's earlier scans, and says plainly that no security verdict was made.

An n8n community node lets n8n workflows and AI agents submit scans, read verdicts, search public scans and look up a domain's scans and DNS history, with no API key - Visit /about

Scans now check whether the pressure tactics on shopping and survey pages are fake: countdown timers that claim an offer is about to end, "people viewing this right now" counters and "only 3 left" warnings. The check runs in testing for now; once it has been evaluated, we plan to use it in the AI Security Verdict.

Improved AI Security Verdict accuracy and clearer explanations for pages that lead to a sign-in form.

Scan results: the Trackers tab now says plainly when a page loaded no trackers, and still lists the tracking IDs found on the page.

The pivot graph no longer joins sites only because their screenshots look broadly alike, which could draw an ordinary site next to an unrelated scam page. Such screenshot matches stay listed in the side panel, where you can add one to the graph by hand - Visit /graph

Script pages: one obfuscation rating, the same on every tab, that tells minified or bundled code apart from obfuscated code more accurately, and steadier segment risk ratings. The Obfuscated Scripts search uses the same rating and lets you pick the minimum level - Visit /js-fingerprint-search

Scan results: click a cookie name to find other scans that set the same cookie, and see how common it is.

Scan results: the list of sites with the same browser features now shows every close match, closest first, with its similarity percentage, instead of one threshold at a time.

In the pivot graph, values that a hunt searches for and threat-intelligence matches are always drawn first, and a scan's details say how many of its values the graph shows, with a link to the full list on its Pivot tab - Visit /graph

Your account page lists the emails we send you: security notices about your account, the three getting-started emails for new accounts, which you can stop or start again, and alerts for the threat hunts you follow - Visit /account

The pivot graph finds pages that look like a site or behave like it, even when they share no exact value, and joins them with a dashed line. A timeline replays how a graph grew, scan by scan; a graph saved as a file opens again just as it was; and values shared by many unrelated sites, such as website builders and widgets, are hidden by default unless a hunt searches for them. On scan results, the Pivot tab marks those widespread values and the values hunts search for - Visit /graph

What you look up stays private: the host listing API lists only hosts found in our own scans, the statistics page shows lookup totals per registered domain and never individual hostnames, and sites we scan because they appeared in lookups are unlisted. The privacy policy explains what our logs record and how long we keep them: server access logs for 14 days, application logs for up to 30 days - Visit /privacy

More in the pivot graph: find highlights every match and steps through them, a link shares a graph exactly as you see it, and large graphs get an overview map and a zoom level. Each site carries a badge for its AI verdict and each value a sign for what it is; near-identical values are merged; scans can be filtered by date; and you can look up the domains using a nameserver, the domains seen on an IP address or a site's hostnames in certificate logs. Signed-in users can turn what selected sites share into a hunt - Visit /graph

The pivot graph stays readable at every zoom: zoomed out, each site is drawn in the colour of its AI verdict and the labels that matter most stay visible. A new Sites view shows only the sites, joined by lines that grow thicker the more values two sites share; point at a line to see what they share, or click it to compare the two sites - Visit /graph

Threat Hunting is easier to work with: search the hunts, filter them by severity, category, what they match on and when they last hit, and see the newest scans that matched a hunt as they arrive. Follow a hunt to get an email when it matches new scans, at most once an hour, and every hunt has an Atom feed of its sightings - Visit /hunts

Brand pages now show a screenshot of every site caught impersonating the brand, the phishing campaigns behind them, where the sites are hosted and how many new ones appear each day. Harmless copies of a brand's own pages are folded away, brands are ranked by the number of distinct sites, and the new brand: search filter finds every scan listed under a brand - Visit /brands

Improved detection of fake verification pages that tell visitors to paste a command into Terminal or PowerShell, including new macOS variants, and the hosts those copied commands download from are now checked against threat intelligence. The Security Verdict is also refreshed when threat-intelligence matches arrive after a scan has finished - Visit /hunts

Improved page reliability on iPhone and Safari: scan results and the home page now load cleanly

Scan results can now show other pages of the same site, each with its own screenshot and full scan - Visit /about#analysis-modules

Improved capture reliability: images and scripts from more hosting providers now load in screenshots as they do in a normal browser - Visit /about#analysis-modules

New detection for fake Korean insurance and contract documents that are really Windows shortcuts that install malware, for fake VPN-client download pages that steal sign-in details, and for more of the hacked websites that show a fake security check telling visitors to paste a command. Files a page downloads, including files inside ZIP archives, are now checked against our detection rules too, and a match counts in the Security Verdict and AI Security Verdict - Visit /hunts

The Deobfuscation tab unpacks one more kind of packed script and shows the unpacked code as a layer of its own - Visit /about#analysis-modules

New detection for fake download pages and altered install scripts for AI tools, and for fake invitations to advertise on AI chatbots, which try to get visitors to run malware or to hand over the account that runs their ads - Visit /hunts

Tracking ID search has a new start page listing the most widespread IDs, an AS number such as AS13335 now finds that network's scans from any search box, and scan times show in your own time zone - Visit /tracking-search

Pivot graph filters now hide everything they cut off and bring back the same graph when ticked again; ticking a filter always grows the graph from what is on screen, or says why it can't; and exports cover only what is shown, with the JSON listing which sites share values - Visit /graph

Scan results now name the website builder a page was made with, including AI app builders such as Lovable, v0, Bolt and Base44, and list the project ID the builder leaves on the page as a tracking ID, so other sites built from the same project are one search away. Technology detection also recognises more of the technologies a page uses - Visit /search-advanced

New detection for the operator panel of a malicious browser extension used by a banking trojan, and more precise detection of fake task-and-earn crypto apps - Visit /hunts

The pivot graph now shows each site once, offers tree, radial, concentric, circle and grid layouts, and keeps large graphs readable - Visit /graph

Improved Security Verdict and AI Security Verdict accuracy, and script analysis now covers more of the scripts a page loads - Visit /about#analysis-modules

Scan results now say when the scanned address returned something other than a web page, such as an API response, a PDF, an image, an archive or a program download, and the AI Security Verdict describes it as what it is - Visit /about#analysis-modules

New pivot graph: start from any public scan and see which other sites share its titles, favicons, tracking IDs, scripts and threat labels, drawn as a graph you can drag, expand, filter and view full screen. It opens two steps out, so sites one or two hops away show up at once, and a graph can be saved as an image or as JSON. Open it from the Pivot tab of a scan result - Visit /graph

Search: a hostname typed with a trailing dot, such as example.com., now finds the same scans as the name without it - Visit /search-advanced

Scan results: the Browser APIs view now lists other sites whose pages used nearly the same set of browser features, which usually means they were built with the same kit, template or site builder, with how close each match is and its AI Security Verdict. The Pivot tab and the new js_feature_similar: search filter find the same pages - Visit /search-advanced?q=js_feature_similar:eee2241f-f189-4686-9464-97526e2e3ae5

Improved capture of websites that are only available over plain HTTP - Visit /about#analysis-modules

While a scan runs, the result page now lists each analysis step as it finishes, so you can see what is done and what is still running - Visit /about#analysis-modules

New detection for fake meeting-app updates and fake document pages that install remote-access software, wider coverage of an exploit-kit loader and of live phishing operator panels, and a label for pages that load an affiliate cookie-stuffing script - Visit /hunts

Improved AI Security Verdict accuracy, and more domains now show their registration date in scan results - Visit /about#analysis-modules

Improved Security Verdict and AI Security Verdict accuracy, with fewer false alarms on web3 apps that connect a crypto wallet - Visit /about#analysis-modules

Large inline scripts are now fingerprinted in full, so script pages and script search match pages that embed the same large script more reliably - Visit /search-advanced

The Deobfuscation tab decodes more scripts, including code hidden by the virtual-machine obfuscation some phishing kits use and scripts embedded in SVG images - Visit /about#analysis-modules

Scan results: the Browser APIs view now notes when a page fingerprints the browser - measuring the audio stack, graphics card, canvas or other device details that can recognise a visitor without cookies - and lists the techniques it used. Anti-bot checks, ads and analytics do this routinely, so it is information, not a verdict. Find such pages with has:browser_fingerprinting - Visit /search-advanced

Scan results: the Pivot tab offers more ways to find related pages - hashes of inline scripts, script hashes that still match after a script is reformatted or partly rewritten, the WebAssembly library or vendor module a page runs, URLs revealed by decoding an obfuscated script, how heavily a page's scripts are obfuscated, rarely used browser features and the names of malicious script patterns - Browse /result/3b7500b0-5aab-40d2-9354-188dc263722d#pivot

Improved search: similar_to always includes exact copies of the script it starts from, wasm_host also finds hosts a WebAssembly module reveals when it runs, obfuscator accepts aaencode and jsfuck, and js_feature recognises the browser features added in recent Chrome versions - Visit /search-advanced

New detection for several phishing kits, exploit-kit loaders and ClickFix variants, and fewer false matches on articles and research pages that describe these threats - Visit /hunts

Faster search: very common words, text in screenshots and nameserver wildcards return in seconds, and scan results, screenshots and previews load faster - Visit /search

The Deobfuscation tab decodes more scripts: it opens on a readable copy, unpacks XOR-encrypted loaders and base64-encoded strings into layers of their own, and says why a script stayed encoded. The Obfuscation tab on scan results lists what the deobfuscator found, with a link to each script, and WebAssembly module pages recognise more kinds of modules - Browse /script/12064248

Improved Security Verdict and AI Security Verdict accuracy, with fewer false alarms on websites' own sign-in pages and clearer explanations of why a page was flagged - Visit /about#analysis-modules

OpenConnector, OOMOL's open-source connector gateway for AI agents, now includes ScanMalware as a provider that needs no API key, so agents connected to it can submit scans, search the archive and look up a domain's scans and DNS history - Visit /about

Text read from screenshots is more accurate, especially on pages in languages that do not use the Latin alphabet - Visit /search-advanced?q=ocr:войти

Improved reliability of the HTTP tab in scan results: its request list, status codes, content types and request timings now appear for every scan that recorded requests

Private Telegram invite links found on a page are now recorded too, so pages that send visitors to the same private group or channel can be found together from the Pivot tab or with the tracking_id filter

Telegram bot tokens and Discord webhooks found in a page’s scripts are now shown in full and can be searched with the new telegram_bot_token, telegram_bot, telegram_chat and discord_webhook filters, so pages that send stolen data to the same bot, chat or webhook can be found together. Discord invites, user profiles and servers linked from a page are now recorded too, and every one of these values appears in the Pivot tab

Scan results: in the Pivot tab, click a count to see what the scans sharing that value are, with their AI Security Verdicts, domains and dates. A new Best pivots first order puts the values a few other scans share at the top, counting is faster with a progress bar, phones get a readable layout, and the tab offers more values to pivot on, such as the sites a page links to and its server headers

Advanced search gains the link_host filter, which finds pages that link to a site, and the server and powered_by filters, which find pages by the server headers their response carried; category searches the content category of every page, and yara_rule also finds rules that matched inside a page’s frames. The is_clone, clone_score and has:clone filters were removed

Scan data now includes page metrics such as memory use, page size and script time

Improved WebAssembly capture: modules are now recorded exactly as the page received them

WebAssembly module pages now tell apart hashing algorithms that share their starting values, such as SHA-256, SHA-512 and the BLAKE2 family, and name the family when nothing in the code singles one out - Browse /wasm/2963d42fe26dba84fe14c2a2d25459fc943068fd7ea0e9e10d8b6811027d41d3

Improved script analysis on very large pages: every script is now analyzed, and more scripts that read their next stage from a blockchain are recognized

WebAssembly module pages now show the module's decompiled code: each function as C-like pseudocode, or each type of a .NET assembly as C#, searchable and opened one at a time. They also list the hosts the code names, with threat-feed matches, and for a .NET app the JavaScript functions it calls in the page - Browse /wasm/b3c295ba49dfc5697572e0ef40cfce9e905f9e9335af1cefceadb54b5705dfa5

Advanced search gains deobfuscation filters: deobfuscated, obfuscator, obfuscation_level, decoded_host, decoded_url, decoded_address, script_finding and script_vendor find pages by what our deobfuscator found in their scripts, such as hosts, URLs and wallet addresses that only appear after decoding, the tool that hid a script, or a script that reads its next stage from a blockchain

The Deobfuscation tab on script pages now shows when a script was analyzed and how long the analysis took. For a script that could not be read as JavaScript, it also shows the parser's message with the line and column - Browse /script/12128329/listener.js

Script pages have a new Deobfuscation tab. It shows how a script was obfuscated, with the tool and techniques used and how much effort went into hiding it, what our deobfuscator decoded or unpacked without running the script, the URLs, hosts and wallet addresses that only became visible after decoding, and the decoded script itself, formatted for reading - Browse /script/12128329/listener.js

WebAssembly module pages now name the hashing and encryption algorithms a module contains, such as SHA-256, AES or ChaCha20, and list the functions that implement them - Browse /wasm/40a211eb1dc8614aa5dc6342dbf5f87e932974ed12557ac0718bd44b771adc25

WebAssembly module pages now list other modules that share code with the one you are viewing, found by comparing every function of every module we have analysed. Builds of the same program are listed as other builds even when their names changed - Browse /wasm/1ad3a28a67f097a39a91d8f987641012f6ec23cb92c8a70b5109ca66e33d2d44

WebAssembly module pages now open with a short summary of what a module is, how it was built and what it can do. They list what a module is made of, such as the Rust crates and versions it was built with or the .NET assembly and the assemblies it references, the checks the analysis ran including those that found nothing, and other builds of the same module. The data chart now shows every encrypted or compressed block - Browse /wasm/dedd9a7b5d8d98b44448bedb371ade1c5327f7bb5dd9effe159da816473a415f

ScanMalware is listed in Claude's connector directory, so Claude can submit scans and search the archive through our MCP server, and a new plugin brings the same tools to Claude Code, Codex and Gemini CLI - Visit /about

Improved detection of hacked websites that show visitors fake verification pages

Scan results now recognise many more tracking and advertising IDs, including CAPTCHA site keys and IDs set inside tag managers

Improved Security Verdict accuracy for phishing and scam pages on free hosting platforms

WebAssembly module pages now list the scripts that carry a module or load it, with how obfuscated each script is, from public scans - Browse /wasm/597fd2a07fed77577d7d47229d691ecccc34fa704434e1ee72bac99c8f389600

WebAssembly module pages now show the fixed text a module hands to the page's JavaScript, such as the page elements it looks for or the address it requests, with web addresses shown as their host. More modules are named too: .NET assemblies of Blazor apps, the meshoptimizer 3D decoder, the Cap captcha, Signifyd's fraud-prevention fingerprint and others - Browse /wasm/cd9785305b5d94c5eedb35114d0c1655d3d35851059af4dd0d2ef587555d9454

Cortex, the analysis engine behind TheHive, now ships a ScanMalware analyzer from Cortex-Analyzers 3.10.1. Look up a domain, hostname, URL or IP against the scan archive from a case, with no API key to obtain - Visit /about

osmedeus, the security orchestration engine for reconnaissance workflows, installs subfinder v2.16.0 from v5.1.2, so its subdomain enumeration queries ScanMalware by default, with no API key to obtain - Visit /about

The About page now tells how ScanMalware started, with a timeline of milestones, and describes recent additions such as WebAssembly analysis, browser feature use, the Pivot tab and the Statistics page - Visit /about

Improved detection of fake verification pages that ask visitors to paste a command, including newer variants that hide what the command does

WebAssembly modules now say in plain words how they were built, for example "Written in Rust. wasm-bindgen connects it to the page's JavaScript." Each module page lists the language, compiler and other build tools named in the module, with what each one does - Browse /wasm/27912f3cdf3acb24062fc7184884c6770751bf450acd32e2c5c5a5338a92f5f5

Scan results show the WebAssembly modules a page used, under Scripts: how each reached the page, what it contains in plain words, known libraries and services, and what it did in our sandbox. Every module has its own page with its structure, the public scans it appeared on and a download - Browse /wasm/27912f3cdf3acb24062fc7184884c6770751bf450acd32e2c5c5a5338a92f5f5

Advanced search gains WebAssembly filters: wasm_label, wasm_family, wasm_toolchain, wasm_host, wasm_export, wasm_import and wasm_size find pages by what their WebAssembly modules contain, such as a known library, a build toolchain, a host named inside the module or an exported function

The Pivot tab now colours each count by how many other public scans share the value, can list the most unique values first, and adds cookie names and the hosts found in a page's scripts

Advanced search gains the cookie_name and js_text_host filters, and searches by script host and by form destination are faster

The Pivot tab on scan results now also lists form destinations, site verification tokens, loaded files, YARA rules, technology versions, cities and brand pages, and counts how many public scans share every value

Advanced search gains the yara_rule, resource_sha256, wasm_sha256, websocket_host, form_host and site_verification filters, city searches cover every server a page contacted, and certificate, registrar and nameserver searches are much faster

The Pivot tab on scan results now covers many more values, including contacted hosts, server IPs, certificate and screenshot fingerprints, scripts and threat intelligence matches, and shows how many public scans share each one

Improved detection of phishing kits aimed at customers of Japanese banks, card issuers and rail services

Improved Security Verdict and AI Security Verdict accuracy for pages that offer or host malware downloads

Copy-and-paste commands on scan results and script pages now name the right operating system instead of always saying Windows

Improved detection of fake CAPTCHA and fake browser-update kits, including overlays that tell visitors to open Windows Terminal

Fewer mistaken listings in the brand impersonation directory - Browse /brands

Scan results: a page that matches several hunts now shows one card for the strongest match, linked to its hunt page, with the other matches listed underneath

More reliable nameserver lookups

New Pivot tab on scan results lists every searchable value of a scan in one table; tick several to find other scans that share them

New Breakdown view in advanced search shows the most common hosting networks, registrars, certificates, technologies and more among the results, with one click to narrow or exclude - Visit /search-advanced

New detection for ClickFix lures aimed at Mac users: fake verification pages that ask visitors to paste a command into Terminal

Advanced search now accepts defanged indicators as pasted (example[.]com, hxxps:// links), several values of one field at once such as domain:(a.com OR b.com), and a new primary_asn: filter for the network hosting the page itself

Subdomain lookups in the API now include www, and list names that no longer exist in DNS separately from live ones

Faster domain searches, and Similar Websites on scan results now finds pages that look the same

Fewer false alarms in the AI Security Verdict, including on companies' own webmail sign-in pages

New detection for fake tax-penalty notices that deliver malware, and for fake document-access pages that collect email addresses for phishing

Improved AI Security Verdict accuracy for hacked websites and for pages that start a program download

Script analysis now covers all the code on pages that run many scripts

Scan results: the Cookies tab now also lists cookies set by third-party sites the page loaded

Scan results: website configuration error pages are no longer reported as bot protection

IP search: a Show all domains button lists every domain seen on an IP address, grouped by registered domain with first and last seen dates, 50 at a time - Visit /search

Browser APIs view: features recorded on bot-check, error and placeholder pages are now marked as such and left out of js_feature: search results - Visit /search-advanced

Scan results: new Browser APIs view in the Scripts tab lists the browser features and web APIs a page used while it loaded, such as WebAssembly, camera or microphone requests, geolocation, fullscreen and clipboard access. They are recorded by the browser itself, so obfuscated code cannot hide them. Each one links to Advanced Search, where the new js_feature: filter finds other pages that used the same feature. Recorded for scans from 26 September 2026 onwards - Visit /search-advanced?q=js_feature:WebAssemblyInstantiation

Certificate Transparency data is far more complete: certificate and subdomain lookups now include nearly all newly logged certificates, and each issued certificate is listed once

Scan results: when a link serves a file, the result now describes the download instead of showing an empty browser tab

Improved AI Security Verdict accuracy for newly launched websites: a brand-new site that only shows its own login page is no longer rated a confirmed scam on its age alone. It is rated moderate risk unless there is further evidence, such as impersonation of another brand, credentials being sent elsewhere, or a threat-intelligence match

New Statistics page: the IP addresses, networks, domains, hosting platforms, countries and cities behind the most malicious websites, threat types, the most popular JavaScript libraries and third-party scripts, the most common JARM and JA4S server fingerprints, and the most viewed scans and most looked-up domains, over the last 12 hours, 24 hours, 7 days or 30 days - Visit /stats

Improved AI Security Verdict wording for very recently registered domains: a domain registered within the last day is now described as at most one day old

Advanced Search: new script_url: filter finds scans that loaded a script from a given path, with * wildcards, so a malicious file planted on many hacked sites can be found by its path - Visit /search-advanced?q=script_url:*/wp-content/plugins/*/js/bsc-loader.js*

New detection for ConsentFix, a ClickFix-style account takeover: the lure page opens a genuine Microsoft sign-in for a trusted tool such as Azure CLI or Azure PowerShell, then asks the visitor to copy or drag the resulting localhost address back into the page, which hands over access to their account without a password ever being typed. Scans now recognise these lure pages from their content and from where their sign-in step leads, the AI Security Verdict rates them high risk, Advanced Search can find them with oauth_code_phishing:true, and three public hunt rules track the technique, including the domains from the first reported campaign - Visit /hunts/af5acf8c-67c3-453f-86d7-142efd4c4497

Nameserver lookups can now be narrowed to one top-level domain, on the nameserver page and with nameserver:X AND tld:se in domain search - Visit /search-domains

Scan results: Related Domains in the Security tab now hides unrelated neighbours on shared hosting and CDN addresses, and links to every domain seen on the page's IP address - Visit /search

Domain search: list the domains that match a query instead of scans, including domains never scanned, each linked to its newest scan - Visit /search-domains

New pivot pages: /ip shows every domain seen on an IP address, grouped by registrable domain, and /ns shows the domains using a nameserver. Both are linked from scan results and IP search - Visit /search

JARM fingerprints are now recorded for more servers

Scan reports now show a JA4S fingerprint for the servers behind each page: a summary of how a server answers a TLS connection, recorded for every server the page connected to and for the JARM probes of the site itself. Each value links to the other scans that met a server answering the same way, and the ja4s: filter searches them in Advanced Search - Visit /search-advanced?q=ja4s:*3f14cc51fb76

Subdomain lookups return more confirmed hosts

CapLoader, Netresec's tool for searching and sorting large packet captures, now looks up an IP address or domain seen in a capture against ScanMalware - Visit /about

Registrar search now works for registrar names that contain a slash

Script analysis: the script and segment views on scan results load faster, and the similar-code search now tells you plainly when a result is complete rather than sampled - Visit /search

Scan results: the HTTP tab now also shows any dialog boxes a page displayed, with their text, and any windows it opened by itself, the tricks behind fake virus warnings and pop-up redirects - Visit /search

Scan results: the HTTP tab now lists any file a page made the browser download, with its name, size, file type and SHA-256, and every resource that failed to load with the reason, so a broken-looking screenshot can be explained from the scan itself - Visit /search

Script analysis: script pages now flag Windows commands hidden in a script for copy-and-paste, the trick used by fake "verify you are human" pages - Visit /search

Scan results: expanding an inline script in the Scripts tab now shows its full source instead of only the first few lines - Visit /search

Search: looking up an IP address with All Fields now also shows the IP Address Information panel with its ASN, location, routing prefixes and DNS names - Visit /search

IP search: the IP Address Information panel now shows the BGP prefixes routing an address from the latest daily routing data, including wider covering prefixes and IPv6 addresses - Visit /search

msticpy, Microsoft's Python toolkit for security investigation and threat hunting, now includes ScanMalware as a threat-intelligence provider from v3.1.0. Look up a domain, hostname, URL or IP against the scan archive from a notebook, with no API key - Visit /about

checkip, a command-line tool that gathers information about an IP address, now runs a ScanMalware check from v0.55.0. It reports the scans in which a page contacted the address and the URLs hosted on it, with no API key to obtain - Visit /about

cyberbro, the tool that checks one observable against many reputation services at once, now ships ScanMalware as a built-in engine from v0.15.0. Select it beside your other sources to add the scan archive to a domain, URL or IP lookup, with no API key to obtain - Visit /about

Advanced Search: the filter reference now lists every available filter, can be searched by name or description, and has an Expand all button - Visit /search-advanced

Streamlined scan results, API documentation and packet capture downloads. In Advanced Search, the second-capture page title filter is now called secondary_title - Visit /search-advanced

Strengthened privacy for private scans across the API, and streamlined API responses. The Chrome net-log download endpoint has been retired - Visit /api-docs

Improved scan result reliability — analysis that finishes while you are on another tab now appears as soon as you return.

Scan results: the Trackers tab is easier to read, with clearer text in both dark and light mode.

Scan results: the Summary tab is more concise. Each figure is shown once, and the request count and total page size are taken from the full page capture.

Scan results: the Summary tab now links to the raw API responses it is built from.

Scan results: the Trackers tab shows how many requests the page made to each tracker.

IP address pages load faster.

Hunt pages can now be found through search engines, and list only publicly shared scans - Visit /hunts

Improved detection of malicious code on large pages and on pages that hide their real content from scanners.

Script pages show more of what we know about a script: the other file names it is served under, the original source files of a bundled script, the matching rule, references and CVE links for each YARA match, and HTTP header details for more scripts.

Script pages list the hosts a script's code calls and those it only mentions, and count the URLs in its source more accurately.

Scan result page metadata now reports the same AI security level as the verdict shown on the page.

Technology detection now uses the latest fingerprints and recognises over 7,600 web technologies.

AI Security Verdict headlines now explain the evidence behind a raised rating.

Improved detection of phishing pages that hide behind a fake "verify you are human" check.

Certificate Transparency status is more accurate: certificates that carry proof they were publicly logged are now shown as logged, and no longer add to the certificate risk score.

Domain registration details now show the registrar for many more domains.

Scan results now list the scanned site's own IP address first, so the location and network shown are the site's own rather than those of a resource it loads.

VulnClaw, an AI penetration-testing agent, now ships ScanMalware as a built-in MCP server from v0.4.0. It is off by default because lookups leave your machine, and one setting gives the agent scan verdicts, Certificate Transparency and infrastructure pivots - Visit /about

You can now delete your account yourself from the Security tab of your account page. Your API keys are deleted and stop working - Visit /account

Your account page has a new Security tab: change your password, manage passkeys and two-factor authentication, and see or sign out your active sessions. Your name and email can be edited from the Overview tab - Visit /account

Your account page keeps you signed in while you use it, and scans you submit while signed in are always saved to your account.

You can now sign in with a one-time link sent to your email address, without typing a password - Visit /account

You can now sign in with a passkey, using your device fingerprint, face or screen lock, or a security key, instead of a password - Visit /account

Scan screenshots are more reliable: results, thumbnails and link previews show the capture that rendered the page, including when a later capture replaces a blank one.

Scan results: tabs can be opened while a scan is still in progress, and links to a specific tab work at any time.

Scan results: the HTTP requests table can now be filtered by status, resource type, local or external host, large, slow and non-GET requests, and by URL, and sorted by size, response time, status or domain.

Visual Search: Find similar now shows scans whose screenshots look alike, and shared links to those results open directly - Visit /semantic-search

Scan results: the Scripts list can now be sorted by size, number of functions or domain.

Scan results and script pages now link each tab to the raw API responses it is built from.

Scan results: the Scripts list can now be filtered by type (local, external, inline), by trusted, large, known library and bundled scripts, and by URL or inline code.

Scan results: Code Segment Analysis now has its own Code Segments tab in the Scripts section, next to Page Analysis and Obfuscation.

Improved AI Security Verdict accuracy for phishing pages that collect login details or personal information.

Improved scan reliability: page resources and site icons are now captured more consistently.

Improved Security Verdict accuracy: more phishing and scam pages are now flagged.

Improved reliability of the domain registration details shown in scan results.

Improved AI Security Verdict accuracy for legitimate websites that use the sign-in or sharing features of well-known platforms.

Improved AI Security Verdict accuracy for phishing links that impersonate the sign-in pages of well-known brands.

Improved detection of SMS phishing pages that impersonate government fines and payment notices.

Every hash on a script's page can now be searched: call graph and function composite hashes join the content hashes, and each opens the scans that contain a matching script - Visit /search-advanced

Seven new Advanced Search filters for scripts: js_call_graph, js_function_composite, js_sha256, js_md5, js_sha1, js_normalized and js_fuzzy - Visit /api-docs

Script analysis shows licence and copyright details more precisely: recognised licence names, tidy copyright notices, and a library identified from the script's own header rather than from code bundled inside it.

Network log downloads now say whether each log is complete, so tools can tell a full capture from a partial one - Visit /api-docs

Advanced search answers page-hash, favicon and JavaScript package searches in well under a second, and every example in the filter reference returns results exactly as written - Visit /search-advanced

The API gives clearer answers: a scan or screenshot that does not exist returns a standard not-found status, similar-scan results are paginated like every other search, and the compressed sitemap downloads as a standard gzip file - Visit /api-docs

Our guide for AI assistants now describes everything the site offers: every API endpoint and every advanced-search filter, and it stays in step with the live service automatically - Visit https://scanmalware.com/llms.txt

The API documentation now includes a complete advanced-search reference: the query syntax and every filter, grouped by topic, each with a ready-made example search - Visit /api-docs#smql-filters

The certificate structure fingerprint on a scan report now links to every other scanned site whose certificate is built the same way, and to sites sharing its extension profile, however common the structure is. The report still shows how many certificates share it and marks rare ones, so you can judge how much a match means - Visit /search-advanced

Scans now examine the domain lookups and encrypted-connection details a page performs, not just the web requests it makes. That brings a large body of network threat-detection rules into play, covering malware and command-and-control activity that is only visible in that part of a site's traffic - see the Security tab on any report

Scan reports now show a JA4X structural fingerprint for a site's TLS certificate: a summary of how the certificate is assembled rather than what it claims, so it stays the same even when the operator changes every name and value inside it. Where that structure is uncommon the report says so and links to the other sites whose certificates are built the same way, which can connect sites that otherwise look unrelated - see the Security tab on any report

Subdomain and certificate lookups are less likely to come back empty when the service is busy: a recent result is now reused rather than returning nothing, and it says how recent it is. Lookups repeated within a couple of days are also answered faster. Where an answer really is incomplete, the API now says so instead of returning an empty result that reads as a definitive 'nothing found', so tools built on it can retry rather than recording a blank - see /api-docs

The AI Security Verdict now runs on a stronger analysis engine and is produced noticeably faster. The engine was chosen after an independent blind review of hundreds of real scans where the old and new analyses disagreed; the speed change was then checked against several hundred more scans spanning the full range of risk levels, and the verdicts reached did not measurably change. Verdicts more often reflect what a page actually is, and the wording and evidence shown on a report are unchanged.

The Brands catalog now covers 676 brands and shows a logo for 417 of them, up from 62 — logos are fetched from each brand's own site and served by ScanMalware, so browsing still involves no third-party requests. Brands are also recognised under far more of their real-world names, including local and legal ones, so a page impersonating "DHL Express" or "Crédit Suisse" is now filed under the brand you would expect; Nordic and regional banks, telecoms and postal services are among the newly covered brands. Brand pages additionally list sites whose page is identical to one already confirmed as impersonating that brand, even when the copy itself names nothing, and where a listing was matched that way it says so, labelled "Identical page", so you can still see exactly what the claim rests on rather than taking it on trust - Browse /brands

Not Found pages no longer send you to the homepage on their own — a mistyped or out-of-date link now stays on screen long enough to read and correct.

Scan results show the analysed page more accurately. On sites that answer an automated visit differently from a browser, the title and captured content on a report now describe the page that was actually examined.

Scans now finish in roughly a third of the time. A typical scan completes in about 30 seconds instead of a minute and a half, so results and verdicts appear sooner after you submit a URL, and large or slow sites are far less likely to run out of time before they finish.

The Brands catalog and brand pages have been rebuilt. The catalog opens on the brands we have findings for, can be sorted and filtered, and loads in under half the data it used to; each brand page lists every site we can substantiate rather than a recent sample, shows what each entry was matched on so you can judge it yourself, offers the full list as CSV, and lets any entry be reported as incorrect. Brand logos are served directly by ScanMalware, so browsing involves no third-party requests.

Pages that could not be read are no longer recorded as clean. When a site refuses the scanner or returns a server error, the verdict is now stored as "Not Assessed" rather than as a safe result — the report page already said so, but the record behind search and the API did not. 28,371 earlier scans have been corrected to match.

Detection of lookalike pages is no longer defeated by trademark symbols or damaged characters in a page title, so a product name written with a symbol between the words is now matched the same as plain text.

A page whose title is the full product name of a major brand, published on free hosting that brand does not control, is now treated as a likely impersonation on that basis alone.

A web address that misspells the brand shown on the page is now treated as a deliberate lookalike, so near-miss domains built to be misread at a glance are rated accordingly.

Sites are no longer flagged for impersonating a brand that is legitimately their own — a sign-in page on the brand's own domain, or the placeholder page a registrar serves on a newly registered domain.

Improved the reliability of site icon capture on scan results — the icon shown beside a scanned site now appears consistently whenever that site provides one.

Network (ASN) pages now show current BGP routing data, including prefix counts and transit providers, and load in about a tenth of a second.

Script analysis has been expanded across scan results and script analysis pages. Scan results list more of the JavaScript a page actually loads, including code served by widely used third-party providers, and report function call counts for modern bundles. Script analysis pages name the bundler identified and how confident that identification is, list the code segments found in inline scripts, and show full segment totals. Searching for code by its fingerprint surfaces more of where the same code appears across scanned sites.

The About page now lists the third-party security tools that include ScanMalware as a built-in source. OpenCTI, MISP, subfinder and subfaster can each query the scan archive directly, so if you already use one of them, ScanMalware is available to it without adding a separate plugin.

Search is faster and more complete. Result pages load about twice as fast, repeat searches return instantly, and searches differing only in capitalisation are recognised as the same search. Domains whose names begin with digits — 163.com, 365364.xyz — now return their full set of matching scans; this shape is common in short-lived phishing and malware hosting. A scan finished within the last ten minutes may take that long to appear in search results; individual scan report pages are unaffected and always show the latest data.

The detection-coverage figure shown on the About page and beneath each scan result counts every threat-intelligence feed in active use during a scan, and reads 21.9 million indicators. This affects the reported figure only — the feeds themselves were already in use, so nothing about how sites are scanned has changed.

Script analysis pages show author details only when a script actually names an author, distinguishing that from the licence wording many scripts share. Existing pages have been updated to match.

Library identification on scan results is more accurate: a script is named as a library only when there is evidence specific to that library, rather than on wording that many libraries share. Existing results have been updated to match, so a script is attributed only to a library it actually contains.

Detection rules that can influence a scan verdict are now reviewed automatically as the rule set updates, so an over-broad new rule is surfaced for review rather than quietly affecting results.

Scan result pages are more reliable: pages display correctly across a wider range of scans, and completed scans always record when they finished so they appear correctly in recent activity.

The Library Composition breakdown on scan results now names each library consistently, collapses long lists behind a show-more control, and is left out when too little of a page was identified for a share of it to mean anything.

Malware scanning now runs on the latest engine release, broadening detection coverage for the files encountered during a scan.

Scan results and search draw on a fuller record of which hosts a page loaded its scripts from, and the trusted marker now covers more of the code a page actually loads.

The script analysis on scan results now shows a complete Library Composition breakdown, with each detected library sized by its share of the identified code.

Improved reliability at peak traffic — scan result pages load without intermittent errors during busy periods.

Sharing a scan link now shows a correct preview for every scan, including sites that could not be reached.

Faster and more complete certificate and DNS history on scan results — fuller subdomain listings for every type of domain name, related domains that share an IP address, and the time period each lookup covers.

Improved brand impersonation accuracy in scan results, with brand names shown consistently across scan results and brand pages, and each listed host linking directly to its scan report.

Search links now fall back to searching all fields when they carry a filter the site does not recognise.

Improved AI Security Verdict accuracy on parked and expired domains — placeholder notices are now recognised as such.

Technology and JavaScript statistics load substantially faster, and report more accurate counts.

Advanced search handles unusual or malformed queries more gracefully, with a clear message rather than an error.

When a site cannot be reached, scan reports now show "Not Assessed" rather than a risk rating — a site we could not load is not a site we found safe.

Every page was being loaded twice, doubling the work behind each visit and slowing reports down. Pages now load once.

Improved Security Verdict accuracy in both directions — better detection of pages built to impersonate well-known companies, and fewer legitimate sites incorrectly flagged.

Scan results are clearer when a page could not be loaded — the report now describes what was and was not observed instead of stating a cause.

API documentation examples now match live responses, and several documented endpoints that returned errors have been fixed - Visit /api-docs

Rebuilt the About page around current detection coverage - Visit /about

Script pages now list known security vulnerabilities affecting the library version a script matches, with the severity of each and the release it is fixed in.

Improved the accuracy of script obfuscation ratings.

Similar Scripts results are limited to genuine structural matches, and each result links through to its own script page.

Script pages show how widely a script's exact content is seen across scans, with first and last sighting, and load faster.

API: domain endpoints now publish a response schema and reject values that are not domains, so a client can tell invalid input apart from a domain we hold no data on.

Domain lookups ignore capitalisation and a trailing dot, so a domain searched in any of those forms returns the same results.

Screenshot hash search finds visually similar screenshots across every scan on record, not only identical ones, with an adjustable similarity range.

Hash search returns results quickly for every supported hash type.

Improved Security Verdict accuracy — fake sign-in pages are more reliably flagged as dangerous, while legitimate company sign-in portals are less likely to be flagged.

Scan results show more complete network detail, listing more of the addresses and networks a site contacted while loading.

Improved AI Security Verdict accuracy. Legitimate sites — including ones that forward visitors to a company's main website — are less likely to receive an elevated risk rating.

Certificate and DNS history on a scan result loads substantially faster, especially for domains with many subdomains.

Scan result pages load faster. They now request only the sections that have something to show, so a result opens with less waiting and less data transferred.

Hash search returns results faster, including for hashes that match nothing.

Previews of scan results shared on other sites now load much faster and use a fraction of the data, and the preview image is sized correctly.

Improved Security Verdict and AI Security Verdict accuracy. Legitimate sign-in pages are less likely to be rated as risky, and pages impersonating a sign-in service are more reliably identified.

Improved AI Security Verdict accuracy for business software. Administrative dashboards and monitoring consoles are less likely to receive an elevated risk rating.

Improved Security Verdict and AI Security Verdict accuracy for well-established organisations. Their sign-in and account pages are less likely to be rated as risky.

Improved Security Verdict accuracy. Harmful sites are less likely to be given a low risk rating, and legitimate sites are less likely to be rated as risky.

Scan results reliably include both the Security Verdict and the AI Security Verdict.

Scan results include a page screenshot far more often, which also means the visual similarity and image analysis sections are populated for more results.

JavaScript analysis on scan results completes for large, script-heavy sites, with the Obfuscation tab and the script sections including the full breakdown.

The progress bar shown while a scan runs follows the scan for its whole duration: it keeps moving until the scan finishes, names the stage currently in progress, and never moves backwards.

Scan results pick up analysis that finishes after the scan itself, so the Obfuscation tab and the AI Security Verdict appear on a results page left open on screen without a manual refresh. A scan that failed shows its state directly rather than placeholder content.

Improved AI Security Verdict accuracy. Legitimate sites — particularly sign-in pages belonging to established organisations — are less likely to receive an elevated risk rating.

Behavioural similarity search results now show how closely each match resembles the script you searched for, along with the per-component breakdown behind that score.

Scan results have a new Obfuscation tab summarising obfuscated JavaScript across the whole page — an overall rating, counts of dynamic code execution, and the highest-risk findings with the code that triggered them. Per-script details were already available under Scripts; this adds the page-level view. The tab appears only for scans where the analysis ran.

Detected JavaScript libraries on scan results show how confident the detection is, in both the script list and the expanded script details.

Scan results populate several additional panels. The embedded-frames panel counts the frames actually flagged and lists why each was flagged, and page statistics, browser console counts and the declared-versus-detected language notice are all shown.

Threat intelligence matches on scan results now say where each indicator was found. A match listed only the indicator, its threat type and its source for around a third of matches; those now also name the location it was seen in and the related domain, host or file hash.

The Bot Protection section on scan results now shows the evidence behind each detection. Detected services were listed with a confidence score, but the evidence rows underneath were blank; each row now names where on the page the signal came from, how much it contributed to the score, and what was matched.

A site already blocked by its own hosting or security provider is rated as dangerous by both the Security Verdict and the AI Security Verdict, across the range of reasons a provider may give for the block.

The AI Security Verdict summary now agrees with the rating above it. A page raised to high risk by a confirmed threat could still be described as low risk in the sentence underneath; that summary now states the finding behind the rating, unless it already described the threat more specifically.

Searching scans by domain is dramatically faster: results typically return in well under a second, including searches for domains we have never scanned, and hold up under heavy load.

Improved AI Security Verdict accuracy for small-business websites whose contact forms are delivered through a third-party form service. When such a form demonstrably delivers to the site's own organisation, that is recognised and reflected in the rating. Sites that ask for passwords or payment details, or that show any other threat signal, are unaffected.

Advanced Search (SMQL) now supports Certificate Transparency filters: ct_domain, ct_san, ct_hash, ct_log and ct_issued let you find scans of domains through their certificate history — for example "ct_domain:*paypa1* AND ct_issued:last30d" surfaces scans of look-alike domains that received a certificate in the last 30 days. Also improved: the certificate-transparency history shown on scan results includes wildcard certificates, and the "domains on this IP" certificate lookup returns reliably - Visit /search-advanced

The API now has published rate limits, which keep heavy automated traffic from affecting scanner performance for everyone else. Normal browsing and everyday API use are unaffected. If you do hit the limit you will get a clear page explaining it, and a free API key — created on your account page and sent with your requests — raises your limit substantially. The limits are listed in the API documentation.

Improved AI Security Verdict accuracy for malicious sites that are already hidden behind a security provider's warning page — these are now consistently rated as dangerous.

New detection for adversary-in-the-middle (AiTM) phishing — "Evilginx"-style attacks that present Microsoft's real sign-in page from a look-alike, non-Microsoft web address to steal both your password and your multi-factor (MFA) session, even when the page looks and behaves exactly like the genuine one. Scanned pages that serve the Microsoft sign-in flow from a non-Microsoft address are now flagged as dangerous. Genuine Microsoft sign-in — including government (sovereign cloud) and Azure AD B2C / Entra business sign-in — is unaffected.

Improved detection of cryptocurrency scam apps that appear blank to automated scanners but load a fake investment or "earn money" app in a real browser. These are now flagged as dangerous and tracked as they reappear on new web addresses. Reputable services are unaffected.

Improved the JavaScript analysis pages — the Security tab reliably lists the malware and obfuscation patterns detected in each script, and the Similar Scripts tab shows full details and working links.

Further reduced Security Verdict false positives on legitimate sites — content-delivery and shared-hosting infrastructure addresses that merely contain a well-known brand name, and sign-in pages on new or lesser-known domains, are flagged as brand impersonation only with concrete evidence of credential theft. Genuine phishing and brand-impersonation pages continue to be flagged.

Improved detection of a stealthy phishing technique that shows security scanners a blank page and only assembles its fake Microsoft sign-in and "device code" authorisation prompt inside the visitor's browser from encrypted content. These pages are now recognised by their structure and flagged as a known malicious kit on the scan result.

New detection for "ClickFix" scams — fake CAPTCHA or error pages that try to trick you into copying and pasting a command into your computer to run malware. When a scanned page attempts this clipboard trick, it is now captured and flagged as dangerous.

Improved detection of cryptocurrency scams — pages that try to steal wallet recovery ("seed") phrases or trick you into connecting a wallet so it can be drained are now more reliably flagged, and scans are checked against an additional continuously-updated list of known crypto-phishing and wallet-drainer sites.

Community reports now help flag threats — when visitors mark a scanned page as malicious, those reports contribute to the Security Verdict and trigger a fresh analysis, so threats reported by the community surface faster. A flood of false reports will not flag a page on its own.

Improved detection of phishing pages that hide their trap — including multi-step "sign in with [brand]" lures that only reveal the credential form after a fake verification or CAPTCHA step, and pages that serve scanners a harmless decoy while showing their real content to ordinary visitors.

Reduced Security Verdict false positives on many kinds of legitimate sites — self-hosted software dashboards and their sign-in pages on your own domain, corporate single sign-on and identity providers, cloud-platform default and error pages, official sites that simply link to a well-known brand, and country-specific domains are flagged as phishing only with concrete evidence of credential theft. Genuine phishing and brand impersonation continue to be flagged.

Faster "Known malicious kit" warnings on scan results — when a scanned site matches one of the phishing or malware kits tracked in our hunt catalog, the warning banner appears on the result page automatically within moments of the analysis finishing, without needing a reload. Hunt pages pick up newly matching scans just as quickly - Visit /hunts

New Page Load Speed rating on scan results — the HTTP tab now shows how a site's page-load time compares with every other site we've scanned, as a simple Very Fast / Fast / Medium / Slow rating along with the percentage of scanned sites it loaded faster than.

Improved Security Verdict accuracy on Microsoft phishing-simulation test pages — links from Microsoft's Attack Simulation Training (the harmless phishing-awareness tests organisations send their own staff) are identified as Microsoft-operated test domains and treated as benign, while genuine Microsoft-impersonation phishing continues to be flagged.

Security Verdict reliability — the brand-impersonation and network-level threat checks are now applied consistently on every scan, so a dangerous page is flagged the first time it is scanned rather than only on a later re-analysis.

Improved detection of brand-impersonation phishing — the Security Verdict now more reliably flags pages that impersonate a well-known brand's sign-in flow (including "device code" login scams that try to trick you into authorising an attacker's access) and pages that display a trusted brand's logo on a look-alike domain. Threat alerts raised at the network level during a scan are now reflected in the Security Verdict as well.

Improved AI Security Verdict accuracy on legitimate sign-in pages — a high-risk verdict for government, municipal, university and other official login portals requires concrete evidence of credential theft rather than the presence of a login form on a low-traffic or unfamiliar domain, while genuine phishing and brand-impersonation pages continue to be flagged.

Improved detection of fake login pages hosted on cloud storage and app-hosting platforms — credential-harvesting pages placed on free file-storage and hosting services are now more reliably flagged as dangerous in the Security Verdict, including ones that don't impersonate a well-known brand.

Reduced Security Verdict false positives from overly-broad threat data — a website is flagged as dangerous on corroborated evidence rather than on sharing a server address with many unrelated sites or on an entry from a discontinued threat list. Genuine, corroborated threats are unaffected.

Improved AI Security Verdict accuracy on new and lesser-known websites — an elevated verdict requires concrete evidence of malicious behaviour rather than a recently-registered domain or a lack of established reputation, reducing false positives on legitimate new sites.

New account dashboard — logged-in users now have an account page showing their submitted scans, recent logins, and API keys. API keys can be created with scopes and expiration dates, revoked at any time (individually or all at once), and used to submit scans and read results programmatically via the X-API-Key header — see the API documentation. Private scans are now available: results are visible only to you when logged in or using your API key.

The perceptual image hashes shown on scan results reflect the captured screenshot, so visual similarity searches between scans work as expected.

Improved phishing detection for sites that hide from automated scanners — pages that show security tools a harmless decoy while serving their real content to ordinary visitors are now more reliably flagged as dangerous.

Improved scan submission reliability — resolved an intermittent issue that caused some recent scans to time out without producing a result. Affected scans can be re-submitted.

Newly-reported threats now appear in scan results faster.

Improved AI Security Verdict accuracy on niche and regional sites — fewer false positives where a login form alone was triggering a high-risk verdict.

Improved AI Security Verdict accuracy on sites hosted on common developer platforms and on sites that use in-browser file handling — these are assessed on their own behaviour rather than treated as inherently suspicious.

Improved AI Security Verdict accuracy — better-corroborated threat reports are weighted more heavily, reducing false positives on widely-used third-party services.

Made the search loading indicator more noticeable — the progress bar shown while results load is now more prominent and stays on screen long enough to see, even on fast searches.

Search results now show a clear loading state when you change the search type — a progress bar at the top of the page and a placeholder table appear while the new results load, instead of the page appearing to pause with no feedback.

Expanded threat-intelligence coverage — scanned URLs are now matched against an additional continuously-updated database of known malware-hosting and phishing URLs, refreshed throughout the day so newly reported threats are caught quickly.

Improved the accuracy of network threat alerts on scan results — the alerts shown reflect genuine findings, with a class of technical false positives filtered out.

Corrected the JavaScript analysis statistics on scan results — the script count, number of static analyses and code-entropy figures were overstated on some scans and now report accurately.

Improved malware-pattern coverage on JavaScript code-analysis pages — script-detail pages now show their full set of pattern matches.

Improved JavaScript fingerprinting — per-function code segments that drive cross-scan code-similarity, library detection, and pattern matching are now recorded for every new scan.

Improved Certificate Transparency and reverse DNS lookup reliability — the certificate history, similar-domain, and rDNS endpoints under /api/v1/ct/ are serving normally.

Search and scan-result pages are now noticeably faster after migrating the search backend onto faster storage — full-cluster searches drop from seconds to under 100 ms, scan-result page loads feel snappier on cold-cache requests

Fixed multi-segment crop-resistant screenshot hash search — the endpoint was rejecting legitimate hash values produced by the imagehash library and now accepts the comma-joined format correctly

Reduced false-positive "Compromised WordPress" flags on legitimate WordPress sites — the detector is more selective about what counts as a compromise indicator.

Improved AI Security Verdict coverage on JavaScript-driven pages — pages whose content is rendered by scripts now reliably receive a full verdict.

Improved IP geolocation accuracy on bot-protected scans — ASN, country and city now stay in sync with the captured IP addresses

Long redirect URLs in scan result headers are collapsed to a single line with a click-to-expand button

Improved JavaScript library detection accuracy — bundler chunk filenames are distinguished from libraries, avoiding spurious version numbers

Fixed intermittent 500 errors on several API endpoints (OCR, favicon search, scan summary, high-risk search, analyzer stats) that occurred after the first cached request

Improved AI Security Verdict accuracy — reduced false positives on corporate sites, news/media, and small business websites.

API: Renamed several response fields for consistency across scan results, nameserver lookups, and PCAP endpoints

Further improved AI brand impersonation detection with contextual awareness for venue names, geographic locations, and corroborating signal requirements

Improved AI security verdict accuracy for brand impersonation detection, reducing false positives on sites that use third-party services

Fixed missing ASN organization names for some IPs in the Domain & IP Information table

New Advanced Search (SMQL) with 120+ filters, boolean logic, and sorting - Browse /search-advanced

Added multi-signal phishing detection for Microsoft 365 credential phishing (AiTM proxies, static clones, obfuscated kits)

Added stable behavioral signatures and behavior vectors for JavaScript similarity clustering - Browse /blog/stable-behavioral-signatures

Improved database query performance and search responsiveness

Fixed "Find Similar" links for behavioral code fingerprints on scan results

Improved scan submission responsiveness and URL validation performance

Improved threat intelligence coverage with additional feed sources and freshness monitoring

Improved YARA malware detection accuracy and updated threat intelligence feeds

Improved JavaScript analysis for external scripts with enhanced hybrid analysis pipeline

Added crypto wallet drainer detection with blockchain RPC monitoring and brand impersonation checks

Improved AI security analysis accuracy and network traffic analysis coverage

Show full certificate hashes in Certificate Transparency Intelligence section

Fixed Certificate Transparency API endpoints to correctly return DNS records and IP addresses for domains

Infrastructure: Resolved search cluster issue and performed disk space optimization

Published blog post: Detecting Coruna, the nation-state iOS exploit kit targeting Safari, with 16 new YARA detection rules - Visit /blog/coruna-ios-exploit-kit-detection

Cleaner RDAP display — IP descriptions exclude cloud-provider internal metadata.

Improved how domain registration age is interpreted across cross-domain redirects.

Security hardening across scan result rendering.

Skip AI analysis for error pages to reduce false alerts

Reduced AI verdict false positives for news and article sites writing about brands

Added title-domain mismatch detection to AI security analysis

Fixed AI verdict false positive for gambling sites misclassified as phishing

Added Content Security Policy header to frontend pages

Fixed search query timeouts for faster hash and fingerprint lookups

Improved accuracy: hosting platform false positive prevention, domain age scoring, and scam taxonomy

Integrated network intrusion-detection alerts into AI Security Verdict for deeper threat detection.

Improved AI security analysis with enhanced phishing detection and reduced false positives for legitimate websites

Scanning performance improved 34x with optimized parallelization

Improved credential exfiltration detection accuracy with reduced false positives

Published blog post analyzing ShinyHunters phishing kit campaign with 21,090 domains scanned - Visit /blog/shinyhunters-phishing-kit-analysis

Added malware warning indicators to script analysis pages

Refined malware detection patterns achieving under 5% false positive rate

Fixed AI analyzer to correctly identify critical malware patterns

Added Meta/Facebook brand detection to security analysis

Fixed AI classification thresholds for more accurate risk scoring

Added trusted domain badge to individual script analysis pages

Improved scan processing reliability with optimized timeout settings for better resource management

Enhanced logging infrastructure for improved performance monitoring across distributed systems

Improved network traffic capture quality by preventing empty packet captures from being stored

Infrastructure: Optimized internal data management for better system performance

Enhanced system health monitoring with TLS certificate analysis status tracking

Enhanced scan pipeline reliability analysis for better error detection and automatic recovery

Improved code analysis accuracy by reducing false positive detections in fingerprint matching

Expand API documentation with 10 new endpoints: YARA malware detection (4 endpoints), registrar search, tracking keys analysis (3 endpoints), Chrome network debug logs, and nameserver domain lookups - Visit /api-docs

Add confidence level indicators when identifying code libraries in scan results

Improved accuracy in library identification by reducing false matches for generic filenames

Launch Model Context Protocol (MCP) server for AI integration - enables Claude Desktop and other AI tools to directly access ScanMalware security scanning capabilities - Visit https://mcp.scanmalware.com

Enhanced library detection accuracy for inline and embedded code blocks

Substantially reduced threat-intelligence false positives on widely-used third-party content delivery services.

Improved library version detection accuracy with better validation logic

Add detection for programming interfaces and system calls used in JavaScript code

Improved reliability of network traffic capture and analysis during scans

Expand library detection capabilities by 355% with 47 new identification signatures

Expanded threat-intelligence coverage to millions of indicators across network, file-hash, and structured-threat data.

Fix scan result page error when analyzing forms with unusual field configurations

Improved tracking of URL redirects to preserve fragment identifiers in destination URLs

Improve code analysis reliability to 100% success rate, eliminating processing errors

Launch automated copyright and licensing detection with 119% improvement in accuracy

Add detection for JavaScript-based navigation and blob URLs for better tracking of client-side URL changes

Add automatic URL preprocessing to unwrap redirect links from social media platforms and URL shorteners

Enhanced IP geolocation display with full country names in Network tab

Performance: Database query optimizations for faster domain search and tracking key lookups

Add WAF and CDN identification to TLS fingerprint analysis across major providers.

Add page-level JavaScript behavioral risk analysis on Scripts tab

Add MD5 and SHA-1 hash search support to JavaScript search with direct links to script detail pages

Improved domain registration (RDAP/WHOIS) caching with smart expiration-based refresh

Improved JavaScript malware analysis with better code segment extraction and pattern matching

Fix technology detection service - improved reliability for website fingerprinting

Infrastructure: Improved network reliability for DNS lookups and domain intelligence

Reduced false positives for legitimate country-specific variants of major brand websites.

Improved form analysis to reduce false positive password field detections

Add business legitimacy assessment for positive trust signals in security analysis

Enhanced form classification to recognize legitimate booking forms and third-party services

Add industry-aware brand detection to reduce false positives for legitimate businesses

Improved scan reliability for sites protected by bot-detection systems.

Add scan visibility selector UI with public, unlisted, and private options (coming soon)

Fix malware scanning service and improve intrusion detection reliability

Performance: Increased search database memory and extended Certificate Transparency query timeout for large searches

Add dual search cluster monitoring to health checks for improved reliability

Enhanced Certificate Transparency search performance and reliability

Improved infrastructure monitoring with enhanced health checks for all services

Refactored internal architecture for better scalability and maintainability

Add dark mode support for YARA malware pattern detection results

Launch YARA malware pattern detection with visual indicators on scan results

Expand YARA malware detection capabilities by 23% (1,250 → 1,540 detection patterns)

Add YARA malware pattern matching to JavaScript analysis for enhanced threat detection

Add automated daily updates for YARA malware detection rules

Launch unified search page with tabs for text, visual, and JavaScript code search

Launch JavaScript Malware Analysis v2.0 with YARA patterns, fuzzy hashing (TLSH), webpack de-bundling, and ML-based code similarity detection

Add library fingerprinting system to identify known JavaScript libraries and isolate suspicious code

Infrastructure improvements: Updated to latest platform versions for better performance and security

Add domain registration and nameserver information to scan results with DNS fallback support

Launch JavaScript obfuscation detection to identify malicious code hiding techniques

Improve scan reliability with automated retry logic, reducing error rate to under 6%

Fix critical scanning issues and enhance error handling for improved stability

Launch hybrid JavaScript fingerprinting with 19x coverage increase for better malware detection

Fix GeoIP data enrichment for network analysis and IP geolocation

Add trusted CDN whitelist badges to Scripts tab for better security transparency

Fix screenshot loading issue on Visual Search page

Add TLS Certificate Analysis API endpoint with CAA validation and Certificate Transparency data - Visit https://scanmalware.com/api-docs#tls

Launch public changelog page with timezone-aware timestamps and clickable links - Visit /changelog

Add RSS feed for changelog updates - Subscribe at /changelog.xml

Launch security blog with articles on TLS certificates, CAA validation, and Certificate Transparency - Visit /blog

Add RSS feed for blog posts - Subscribe at /rss.xml

Add tag filtering for blog posts - Browse posts by topic

Performance improvement: Database optimizations

Add daily automated browser profile warmup for better bot detection evasion

Expand browser profile warmup from 5 to 10 popular websites

Security: Browser workers now run as non-root user for improved security

Add CAA validation and certificate validity period checks to TLS analyzer

Add hostname validation and certificate chain validation to TLS analyzer

Add comprehensive security certificate test validation

Fix TLS analyzer ECDSA key size false positive

Implement TLS Certificate Analyzer with Certificate Transparency enrichment

Optimize JavaScript fingerprinting performance

Add CJK script detection and language code normalization

Implement improved multi-signal language detection

Implement multi-signal phishing clone detection

Remove white background from favicons, make transparent

Fix URL manipulation false positive for hash fragments in single-page apps

Fix browser error URL exposure and improve AI analysis continuation logic

Improved JavaScript fingerprinting processing speed with parallel workers

Fix HTML upload race condition with inline data storage

Enhanced reliability for JavaScript file downloads and analysis

Fix null checks in expanded fingerprint metrics section

Fix null handling for function count in JavaScript fingerprints

Add obfuscated JavaScript detection for improved malware identification

Add expanded JavaScript fingerprint metrics view

Implement JavaScript fingerprinting feature for malware detection

Faster JavaScript fingerprinting results for newly submitted scans