01 · Product name
urlscan
Open a URL in a sandbox and keep the screenshot, DOM, and requests.
Published by urlscan.io.
In short
urlscan.io loads a URL in a controlled browser and records what the page does: a screenshot, the DOM, and the network requests. You can also search scans other people have already made public. Public scans and search are free within rate limits. Private scans and higher API volume are paid. It is a lookup for a link, not a license to visit infrastructure you do not own.
Product pricing strategy
02
Free and paid
urlscan is free to start and paid when you need more. The free tier is the on-ramp. Volume, locked filters, private scans, or an API are what paid plans usually add. Confirm the current split on the vendor site. This listing does not invent a dollar amount.
Public scans and search are free within rate limits. Private scans and higher API limits are paid. Check urlscan.io for the current plan.
Utility and features
03
urlscan is the page you open when a link is the only lead. Submitting a URL renders it away from your own browser, then stores the screenshot and the requests the page made — scripts, redirects, and the hosts it called. Searching existing public scans answers a quieter question: has anyone already looked at this URL, and what did it load then?
- What a scan stores. A screenshot, page DOM, and the HTTP requests made while the page loaded, including redirects. Read the date. Pages change.
- Search versus submit. Search looks at scans already public. Submit creates a new one. Prefer search when the URL may be sensitive and you only need to know if it was seen.
- Free and paid. Public scans and search have a free allowance. Private scans and higher API volume are paid. The pricing page is the source for current limits.
The free tier is enough to check a suspicious link or to learn the result page. Private visibility and serious API use sit on paid plans; confirm the current limits on urlscan.io before you script it. A scan shows what that page did at that moment. It does not prove the infrastructure is malicious, and it does not authorize you to probe the hosts in the request list. VirusTotal is the companion when you want multi-engine verdicts. Shodan and Censys answer what is listening on an address, which is a different job.
- 1
Search the URL before you submit it. A recent public scan may already answer the question.
- 2
If you submit, choose a visibility that matches the case. Do not make a confidential link public by accident.
- 3
Read the request list and the screenshot together. A benign-looking page can still call a bad host.
- 4
Corroborate with VirusTotal when you need a verdict, and stop before you scan hosts you are not allowed to touch.
Caveats
04
urlscan loads a URL and records what happened. Public scans are visible to other users. Do not submit URLs that carry session tokens, personal data, or anything your organization would not publish.
The screenshot can be a cloaked page that shows different content to their scanners than to a person. One scan is one moment. The free tier and the API have limits the vendor sets. This listing does not invent the quota. VirusTotal answers a reputation question. urlscan answers what the page did when loaded.
Screenshots
05
Potential use cases
06
- You have a phishing URL and you do not want it in your daily browser. Submit it to urlscan, or open a recent public scan if one exists. The output is a screenshot, the page DOM details the product stores, and the requests the page made. Pivot a domain or hash from those requests to VirusTotal. A scan is a detonation in their environment, under their policies. Read those before you submit a URL that contains a token or a person’s data.
- You need to know whether a URL was scanned recently by someone else. Search it. The output is prior scans and their dates, which can be enough. A missing scan means nobody submitted it there, not that the URL is safe. Submit only if you are allowed to, and expect the result to be public if you used the public scan.
- A dated screenshot has to go in the notes. Use the scan’s own page and record the scan UUID and time. That is a better exhibit than a phone photo of your monitor. Pivot to the Wayback Machine if you need an older copy of a legitimate site rather than a phish detonation. urlscan does not tell you who sent the mail.
Hard cases
The case where the first result is easy to over-read.
The phish URL has the target’s address in the query string
Submitting the raw link publishes that address on a public scan. Strip the query, or use a private scan if your plan has one and your policy allows it. If you cannot submit it cleanly, search for a scan that already exists and do not create a new public record of the victim. The screenshot you wanted is not worth doxxing the person who received the mail.
Questions
Is urlscan free?
Public scans and search are free within rate limits. Private scans and higher API limits are paid. Check urlscan.io for the current plan.
Does a urlscan result mean a site is malicious?
No. It shows what the page loaded when it was scanned. Pair it with a verdict from VirusTotal and with the context of the case before you call a host hostile.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
urlscan.io
https://urlscan.io/Pricing
urlscan.io pricing
https://urlscan.io/pricing/Documentation
urlscan.io documentation
https://urlscan.io/docs/