urlscan.io API
Free urlscan.io search API with no key: search millions of website scans for domains, IPs and page content to investigate phishing and malicious sites. Tested.
Endpoint tested and returned HTTP 200 on 2026-08-20
What is the urlscan.io API?
urlscan.io provides a free, key-free search API over its database of millions of website scans, letting you investigate domains, IP addresses, page content and screenshots to identify phishing and malicious infrastructure.
urlscan.io scans websites in a sandboxed browser and records everything — requests made, domains contacted, page content, screenshots and technologies detected. The search API queries that historical corpus.
It is widely used in security operations for phishing investigation: searching for a brand name in page content reveals sites impersonating it, and searching by IP or ASN maps out related malicious infrastructure. Search is key-free; submitting new scans requires a free API key.
Quick facts
- Base URL
https://urlscan.io/api/v1- Authentication
- Search requires no key. Submitting new scans requires a free API key.
- Rate limit
- Roughly 60 search requests per minute unauthenticated.
- Pricing
- Free tier for search and public scans; paid plans for commercial and private use.
- CORS
- Not enabled — call it from your server
- Official docs
- Read the docs
How to use the urlscan.io API
Every request below was executed against the live API on 2026-08-20, and the response shown is the real body it returned — not an illustration.
1. Search historical website scans
GET https://urlscan.io/api/v1/search/?q=domain%3Aexample.com&size=1
curl 'https://urlscan.io/api/v1/search/?q=domain%3Aexample.com&size=1'const res = await fetch("https://urlscan.io/api/v1/search/?q=domain%3Aexample.com&size=1");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);import requests
res = requests.get("https://urlscan.io/api/v1/search/?q=domain%3Aexample.com&size=1", timeout=20)
res.raise_for_status()
print(res.json()){
"results": [
{
"canonical": {
"task": {
"url": "accountschallenge-v3slgnin-identifier-continue.com"
},
"page": {
"url": "example.com"
}
},
"task": {
"visibility": "public",
"method": "automatic",
"domain": "accountschallenge-v3slgnin-identifier-continue.com",
"apexDomain": "accountschallenge-v3slgnin-identifier-continue.com",
"time": "2026-08-19T21:10:49.659Z",
"source": "certstream-suspicious",
"uuid": "01a01bdc-a9b2-7563-9a1c-72fd39b2d216",
"url": "https://accountschallenge-v3slgnin-identifier-continue.com/"
},
"stats": {
"uniqIPs": 2,
"uniqCountries": 2,
"dataLength": 975,
"encodedDataLength": 878,
"requests": 2
},
"page": {
"server": "cloudflare",
"redirected": "off-domain",
"ip": "172.66.147.243",
"apexDomainAgeDays": 4269,
"language": "en",
"mimeType": "text/html",
"title": "Example Domain",
"url": "https://example.com/",
"tlsValidDays": 90,
"tlsAgeDays": 20,
"domainAgeDays": 4269,
"tlsValidFrom": "2026-07-29T22:10:08.000Z",
"domain": "example.com",
"umbrellaRank": 6980,
"apexDomain": "example.com",
"asnname": "CLOUDFLARENET - Cloudflare, Inc., US",
"asn": "AS13335",
"tlsIssuer": "Cloudflare TLS Issuing ECC CA 3",
"status": "200"
},
"_id": "01a01bdc-a9b2-7563-9a1c-72fd39b2d216",
"_score": null,Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
q | string | Required | Elasticsearch-style query. domain:example.com |
size | integer | Optional | Results per page, max 100 unauthenticated. 10 |
search_after | string | Optional | Cursor for deep pagination. 1234,abcd |
Response fields
totalinteger- Total scans matching the query.
results[].taskobject- Scan metadata — time, submitted URL, visibility.
results[].pageobject- Resolved page details including domain, IP, ASN and country.
results[].statsobject- Request counts and unique domains contacted.
results[].screenshotstring- URL of the captured screenshot.
results[]._idstring- Scan id — fetch full results at /api/v1/result/{id}/.
What you can build with the urlscan.io API
- Investigate phishing sites impersonating a brand
- Map malicious infrastructure by IP, ASN or certificate
- Check what a suspicious URL loads without visiting it
- Enrich threat intelligence with historical scan data
Common errors and how to fix them
429
Unauthenticated search limit exceeded.
Fix: Roughly 60 requests per minute; register a free API key for more.
Query syntax errors
The q parameter uses Elasticsearch syntax.
Fix: Use field:value form such as domain:example.com or page.ip:1.2.3.4.
Sensitive data in public scans
Public scans are visible to everyone.
Fix: Never submit URLs containing tokens or session identifiers — they become permanently searchable.
urlscan.io API — frequently asked questions
Is urlscan.io free?
Search over public scans is free with no API key. Submitting new scans requires a free API key, and commercial or private use needs a paid plan.
What can I search for?
Domains, IP addresses, ASNs, page content, technologies and certificate details, using Elasticsearch-style field:value queries.
Is it safe to look up a malicious URL?
Yes — that is the point. urlscan visits sites in its own sandbox, so you can inspect what a URL loads, including screenshots, without visiting it yourself.
Are my scans private?
Public by default, meaning anyone can search them. Never submit URLs containing session tokens or private parameters unless you set the scan to private, which requires an account.
Tools that pair with this API
JSON Formatter
Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.
URL Encoder
Percent-encode text for URLs instantly. Switch between encodeURIComponent and encodeURI modes, see live output and copy the result. Free URL encoder.
urlscan.io is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-20; always check the official documentation before relying on this API in production, as terms and limits can change.