BYTETOOLS

urlscan.io API

Free urlscan.io search API with no key: search millions of website scans for domains, IPs and page content to investigate phishing and malicious sites. Tested.

No API key requiredHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-20

What is the urlscan.io API?

urlscan.io provides a free, key-free search API over its database of millions of website scans, letting you investigate domains, IP addresses, page content and screenshots to identify phishing and malicious infrastructure.

urlscan.io scans websites in a sandboxed browser and records everything — requests made, domains contacted, page content, screenshots and technologies detected. The search API queries that historical corpus.

It is widely used in security operations for phishing investigation: searching for a brand name in page content reveals sites impersonating it, and searching by IP or ASN maps out related malicious infrastructure. Search is key-free; submitting new scans requires a free API key.

Quick facts

Base URL
https://urlscan.io/api/v1
Authentication
Search requires no key. Submitting new scans requires a free API key.
Rate limit
Roughly 60 search requests per minute unauthenticated.
Pricing
Free tier for search and public scans; paid plans for commercial and private use.
CORS
Not enabled — call it from your server
Official docs
Read the docs

How to use the urlscan.io API

Every request below was executed against the live API on 2026-08-20, and the response shown is the real body it returned — not an illustration.

1. Search historical website scans

GET https://urlscan.io/api/v1/search/?q=domain%3Aexample.com&size=1

curl
curl 'https://urlscan.io/api/v1/search/?q=domain%3Aexample.com&size=1'
JavaScript (fetch)
const res = await fetch("https://urlscan.io/api/v1/search/?q=domain%3Aexample.com&size=1");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);
Python (requests)
import requests

res = requests.get("https://urlscan.io/api/v1/search/?q=domain%3Aexample.com&size=1", timeout=20)
res.raise_for_status()
print(res.json())
Response — HTTP 200 (truncated)
{
  "results": [
    {
      "canonical": {
        "task": {
          "url": "accountschallenge-v3slgnin-identifier-continue.com"
        },
        "page": {
          "url": "example.com"
        }
      },
      "task": {
        "visibility": "public",
        "method": "automatic",
        "domain": "accountschallenge-v3slgnin-identifier-continue.com",
        "apexDomain": "accountschallenge-v3slgnin-identifier-continue.com",
        "time": "2026-08-19T21:10:49.659Z",
        "source": "certstream-suspicious",
        "uuid": "01a01bdc-a9b2-7563-9a1c-72fd39b2d216",
        "url": "https://accountschallenge-v3slgnin-identifier-continue.com/"
      },
      "stats": {
        "uniqIPs": 2,
        "uniqCountries": 2,
        "dataLength": 975,
        "encodedDataLength": 878,
        "requests": 2
      },
      "page": {
        "server": "cloudflare",
        "redirected": "off-domain",
        "ip": "172.66.147.243",
        "apexDomainAgeDays": 4269,
        "language": "en",
        "mimeType": "text/html",
        "title": "Example Domain",
        "url": "https://example.com/",
        "tlsValidDays": 90,
        "tlsAgeDays": 20,
        "domainAgeDays": 4269,
        "tlsValidFrom": "2026-07-29T22:10:08.000Z",
        "domain": "example.com",
        "umbrellaRank": 6980,
        "apexDomain": "example.com",
        "asnname": "CLOUDFLARENET - Cloudflare, Inc., US",
        "asn": "AS13335",
        "tlsIssuer": "Cloudflare TLS Issuing ECC CA 3",
        "status": "200"
      },
      "_id": "01a01bdc-a9b2-7563-9a1c-72fd39b2d216",
      "_score": null,

Parameters

ParameterTypeRequiredDescription
qstringRequiredElasticsearch-style query. domain:example.com
sizeintegerOptionalResults per page, max 100 unauthenticated. 10
search_afterstringOptionalCursor for deep pagination. 1234,abcd

Response fields

totalinteger
Total scans matching the query.
results[].taskobject
Scan metadata — time, submitted URL, visibility.
results[].pageobject
Resolved page details including domain, IP, ASN and country.
results[].statsobject
Request counts and unique domains contacted.
results[].screenshotstring
URL of the captured screenshot.
results[]._idstring
Scan id — fetch full results at /api/v1/result/{id}/.

What you can build with the urlscan.io API

  • Investigate phishing sites impersonating a brand
  • Map malicious infrastructure by IP, ASN or certificate
  • Check what a suspicious URL loads without visiting it
  • Enrich threat intelligence with historical scan data

Common errors and how to fix them

429

Unauthenticated search limit exceeded.

Fix: Roughly 60 requests per minute; register a free API key for more.

Query syntax errors

The q parameter uses Elasticsearch syntax.

Fix: Use field:value form such as domain:example.com or page.ip:1.2.3.4.

Sensitive data in public scans

Public scans are visible to everyone.

Fix: Never submit URLs containing tokens or session identifiers — they become permanently searchable.

urlscan.io API — frequently asked questions

Is urlscan.io free?

Search over public scans is free with no API key. Submitting new scans requires a free API key, and commercial or private use needs a paid plan.

What can I search for?

Domains, IP addresses, ASNs, page content, technologies and certificate details, using Elasticsearch-style field:value queries.

Is it safe to look up a malicious URL?

Yes — that is the point. urlscan visits sites in its own sandbox, so you can inspect what a URL loads, including screenshots, without visiting it yourself.

Are my scans private?

Public by default, meaning anyone can search them. Never submit URLs containing session tokens or private parameters unless you set the scan to private, which requires an account.

Tools that pair with this API

urlscan.io is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-20; always check the official documentation before relying on this API in production, as terms and limits can change.