Submit a URL to urlscan.io for a fresh sandbox scan.

Call this when you have a suspicious or unknown URL and want live analysis: what it loads, where it redirects, what infrastructure it contacts, and whether urlscan flags it as malicious. Returns a scan uuid — then poll get_url_result with that uuid to fetch findings.

OPSEC — visibility defaults to 'unlisted' on purpose. A public scan is indexed and browsable by anyone, including the adversary, who may be watching urlscan for scans of their own infrastructure. Scanning their URL publicly tips them off that they are under investigation and can burn the operation. Use 'public' only when you deliberately want the result shared; use 'private' for the most sensitive cases.

Fetch the results of a urlscan.io scan by its uuid.

Call this after scan_url to retrieve the verdict and the contacted infrastructure (domains, IPs, ASN, hosting country, page title, TLS issuer). Scans take roughly 10-30 seconds; if this fails with an error of kind 'pending', wait a few seconds and call again.

Search urlscan.io's historical scan database (Elasticsearch query syntax).

Call this to find existing scans instead of running a new one — e.g. to see every scan that touched a domain/IP, hunt for a favicon or TLS-cert hash across sites, or discover other pages hosted on the same infrastructure. This is passive: it does not touch the target, so it's safe to use freely during an investigation. Returns a short list of matching scans with their domains, IPs, ASN and result links to pivot from.

Look up a file hash on VirusTotal.

Call this when you have a file hash (from a sample, an email attachment, an EDR alert, a sandbox report) and want to know whether it's known-malicious: the multi-engine detection ratio, the suggested threat label/family, file type and size, and first/last-seen dates. Accepts MD5, SHA-1 or SHA-256. Returns a compact summary, not the full per-engine report.

Look up a domain on VirusTotal.

Call this to assess a domain indicator: its detection ratio across URL/domain engines, reputation score, registrar and creation date (a recent creation date is a strong newly-registered-domain signal), and category tags. Useful when pivoting from a URL or email sender to the domain behind it. Returns a compact summary.

Look up an IP address on VirusTotal.

Call this to get hosting context and reputation for an IP indicator: the detection ratio, reputation score, ASN, owning organization, network range and country. Useful when pivoting from a domain's resolved IP or a urlscan-reported page_ip to understand who hosts the infrastructure. Returns a compact summary.