# ScanMalware.com

> Free online URL and website security scanner. Submit any URL for analysis in an
> isolated headless-Chrome sandbox and get malware, phishing, JavaScript-threat and
> infrastructure findings, plus a searchable archive of every past scan.

## What is ScanMalware?

ScanMalware.com is a website security analysis platform in the same family as urlscan.io.
Each scan renders the page in a disposable containerised browser behind an intercepting
proxy, then records what the page did rather than only what it claimed to be:

- Screenshot, rendered DOM and stored HTML
- Every network request, response header, IP, ASN and TLS certificate
- JavaScript captured both from the DOM and from the wire
- YARA and pattern matching over script bodies and page content
- Technology and library detection
- Certificate Transparency and passive DNS history for the domain
- Threat-feed and indicator-of-compromise matching
- Two independent security verdicts: a deterministic rule engine and an AI analysis

Scans are public by default and permanently addressable, so a result URL can be cited.

## Key pages

- [Home](https://scanmalware.com/): submit a URL for scanning
- [Search](https://scanmalware.com/search): search every scan by URL, domain, IP, ASN, hash or technology
- [Advanced search](https://scanmalware.com/search-advanced): the full structured query language (SMQL)
- [JavaScript fingerprint search](https://scanmalware.com/js-fingerprint-search): find scans by script hash or fingerprint
- [Semantic search](https://scanmalware.com/semantic-search): search by meaning rather than exact text
- [Tracking search](https://scanmalware.com/tracking-search): find pages by tracker or analytics identifier
- [Hunts](https://scanmalware.com/hunts): saved queries that keep matching new scans; create at [/hunts/new](https://scanmalware.com/hunts/new)
- [Brands](https://scanmalware.com/brands): brands seen impersonated, and the pages doing it
- [Blog](https://scanmalware.com/blog): security research write-ups
- [Changelog](https://scanmalware.com/changelog): what changed on the platform, newest first
- [API reference](https://scanmalware.com/api-docs): full endpoint documentation
- [About](https://scanmalware.com/about) · [Contact](https://scanmalware.com/contact) · [Privacy](https://scanmalware.com/privacy) · [Terms](https://scanmalware.com/terms) · [Account](https://scanmalware.com/account)

Per-item pages follow stable URL patterns, reachable from the pages above or from
[/sitemap.xml](https://scanmalware.com/sitemap.xml):

- `/result/{scan_id}` — full scan report: verdicts, screenshot, network, scripts, cookies,
  redirects, certificates, technologies
- `/script/{...}` — one JavaScript file: hashes, library and bundler identification,
  obfuscation signals, and where else it appears
- `/brands/{slug}` — one brand · `/technology/{slug}` — sites running a technology ·
  `/asn/{asn}` — activity by network operator · `/blog/tag/{tag}` — posts by tag

## API

Base URL `https://scanmalware.com/api`. Full reference: [API documentation](https://scanmalware.com/api-docs)

Core endpoints:

- `POST /api/v1/scan` — submit a URL; returns a `scan_id`
- `GET /api/v1/result/{scan_id}` — the full scan record
- `GET /api/v1/search` — search scans
- `GET /api/v1/scans/{scan_id}/jsfingerprints` — JavaScript analysis for one scan

Also available, among ~178 documented endpoints:

- `GET /api/v1/search/smql` — structured query language over scans
- `GET /api/v1/search/ip/{ip}`, `/api/v1/search/asn/{asn}` — infrastructure pivots
- `GET /api/v1/search/favicon/{hash}`, `/api/v1/search/screenshot/{type}/{hash}` —
  pivot on visual identity
- `GET /api/v1/search/semantic`, `/api/v1/search/similar` — nearest-neighbour search
- `GET /api/v1/jsfingerprint/hash/sha256/{hash}` — every scan serving a given script
- `GET /api/v1/jsfingerprint/library/{library}` — sites using a library, optionally
  `/version/{version}`
- `GET /api/v1/ct/{domain}`, `/api/v1/ct/dns/{domain}`, `/api/v1/ct/timeline/{domain}` —
  certificate and DNS history
- `GET /api/v1/domain/history/{domain}`, `/api/v1/domains/{domain}/scans` — per-domain view
- `GET /api/v1/brands`, `/api/v1/brands/{slug}` — brand impersonation data
- `GET /api/v1/hunts`, `POST /api/v1/hunts` — saved hunts

## Data available per scan

Screenshot, stored HTML, network requests and responses, JavaScript files with hashes and
fingerprints, detected technologies and libraries, TLS certificate chain, WHOIS/RDAP,
IP geolocation and ASN, cookies, redirect chain, console output, and both security verdicts
with the evidence behind them.

## Please do not crawl

`robots.txt` disallows `/api/` and `/hash-search`, and those rules are the authority. The
API is documented above for programmatic use with a known `scan_id` or query, not for
crawling; `/hash-search` generates unbounded URL permutations and is a crawler trap.
Prefer `/sitemap.xml` for discovery.

## Contact

- [Website](https://scanmalware.com)
- [Contact form](https://scanmalware.com/contact)
- X/Twitter: @scanmalware