urlscan.io

What it is

An online service that opens a submitted link in an automated browser the way a regular user would, then records the domains, IPs, scripts, cookies, DOM, and a screenshot. Pages that imitate one of more than 3,000 tracked brands are flagged as potentially malicious.

What it helps with

- Checking a phishing link without opening it on your own machine
- Pivoting from one domain or IP to other scans that touched it
- Automating scans and searches through the API
- Hunting for new phishing pages with the paid Pro product

Who it's for

SOC analysts, threat intelligence teams, and researchers investigating suspicious websites.

Worth knowing

Scans can be public, unlisted, or private, and public scans are visible to everyone, so do not submit links containing sensitive data as public. Paid plans add scans from residential IPs, Tor, and chosen countries.

When did the service start?
It was created in late 2016 by Johannes Gilger.

Is there a way to report a malicious page while keeping it out of public search?
Yes, unlisted scans are hidden from the public but visible to Pro users.