search_scans
Search historical urlscan.io data with ElasticSearch queries to locate domains, IPs, and indicators by criteria like page.domain, verdicts.score, or task.tags.
Instructions
Search historical urlscan.io scans with an ElasticSearch query string.
Useful fields: page.domain, page.ip, page.asn, page.server, page.status, domain, ip, asn, country, hash, filename, task.tags, verdicts.score, verdicts.malicious, date.
Examples: page.domain:example.com AND page.status:200 task.tags:phishing AND date:>now-30d verdicts.score:>50 AND page.asn:AS15169
Works without an API key, at lower rate limits.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | ||
| query | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||