urlscan.io
urlscan.io is a website scanning and analysis service that visits submitted URLs in an automated browser and records requests, domains, IPs, resources, screenshots, DOM content, cookies, and other web-page behavior.
What urlscan.io is
urlscan.io official site is a website scanner and analysis service for suspicious or interesting URLs. When a URL is submitted, the service loads it in an automated browsing environment and records what the page does, which makes it useful for phishing analysis, malware triage, redirects, and web-infrastructure investigation.
Automated page scanning
The official About page explains that urlscan.io browses a submitted URL like a regular user and records the activity created by the navigation. That can include contacted domains and IP addresses, requested JavaScript and CSS files, page metadata, DOM content, cookies, global JavaScript variables, and other observations that help explain what happened during the visit.
Phishing and redirect analysis
A URL may look simple in an email or message, but the browser can follow redirects, load third-party scripts, contact many hosts, and present different content depending on geography or timing. urlscan.io helps analysts see those relationships without manually clicking through a potentially risky page in their normal browser.
Public scans and privacy
Public scans can be searched and reviewed by other users, which is powerful for shared threat research but risky for sensitive links. Users should avoid submitting private documents, personal reset links, customer portals, internal URLs, or secret-bearing URLs as public scans. Sensitive work requires careful visibility settings and organizational policy.
Search and archived results
The Search API documentation describes searching archived scans by structured fields such as page domain, task tags, HTTP status, submitted URL, DOM hash, and other scan properties. This lets researchers pivot from one suspicious page to related infrastructure, repeated templates, domains, or technical patterns.
API workflows
urlscan.io's API documentation covers scan submission, result retrieval, DOM and screenshot access, and quota-aware search workflows. Security teams can integrate those endpoints into alert triage, phishing intake, case management, and automated enrichment systems.
Who uses urlscan.io
urlscan.io is used by security analysts, SOC teams, phishing responders, threat-intelligence researchers, abuse desks, journalists, and everyday users who want to inspect a suspicious link. Its value comes from turning a web visit into a report that can be searched, shared, and compared.
Why it matters
Modern phishing and scam pages often hide behind redirect chains, short-lived domains, cloud-hosted assets, brand impersonation, and evasive behavior. urlscan.io matters because it gives defenders a repeatable way to observe and document what a URL does, then connect that behavior to broader patterns.
WHOIS domain data
Data pulled: May 23, 2026View current WHOIS record
- Domain
- urlscan.io
- IP address
- 49.12.22.106
- Registrar
- Gandi SAS
- WHOIS server
- whois.gandi.net
- Referral URL
- https://www.gandi.net
- Created
- February 17, 2016
- Updated
- January 13, 2026
- Expires
- February 17, 2027
- Nameservers
- ns-1558.awsdns-02.co.uk (205.251.198.22); ns-483.awsdns-60.com (205.251.193.227); ns-1198.awsdns-21.org (205.251.196.174); ns-940.awsdns-53.net (205.251.195.172)
- Domain status
- clientTransferProhibited https://icann.org/epp#clientTransferProhibited
- Contact privacy
- Registrant contact details are redacted for privacy; the visible registrant country is DE.