ScanMalware.com URL Scanner

GetList analyzerwhich resultsanalysis modules ran for one scan (for example JavaScript fingerprinting and AI analysis), with each module's status, success flag and timing. Useful for checking why a scan_id.result is missing. scan_id is the UUID of a ScanMalware scan.

Get analyzerplatform-wide statistics overview.for the scan analysis modules: the modules and their run counts. Describes the service, not a particular scan.

Get APIthe rootScanMalware metadata.API's name, version, status, main endpoints and feature list.

Get the bot-protection detectionand CAPTCHA services detected on a scanned page (for example Cloudflare Turnstile), with a scan_id.detected flag. Phishing kits often use these to hide from scanners. scan_id is the UUID of a ScanMalware scan.

Get capabilitythe statssize byof date.ScanMalware's detection content (indicators, detection rules, ClamAV signatures) on a given date (scan_date, YYYY-MM-DD).

Get the clipboard eventswrites forthe page attempted while it was scanned, with the event count and whether collection ran. Empty with an explanatory note when the page wrote nothing. scan_id is the UUID of a scan_id.ScanMalware scan.

Get clipboard statistics.and pastejacking statistics across the archive: event totals, detections and daily activity.

GetList CPEsthe CPE identifiers (product and version names in the NVD format) derived from the technologies detected on a scanned page, with their source. Useful for matching against vulnerability data. scan_id is the UUID of a scan_id.ScanMalware scan.

Get CPE statistics.statistics across the archive: scans with CPEs, unique CPEs, total detections, top vendors and products.

Get certificatethe transparencycertificates dataissued for a domain.domain according to Certificate Transparency logs, with a found flag.

GetList CTsubdomains of a domain found through Certificate Transparency, with their DNS records (type, IP addresses, TTL) and when they were seen. Useful for finding the other hosts of a domain.

Find CTList domains onthat Certificate Transparency and DNS data associate with an IP address.address, with record counts and the total.

Find domains with names similar CTto domainsa domain in Certificate Transparency data (for example lookalikes and typosquats), each with a domain.certificate count and the kind of similarity.

Get CTthe certificate timelinehistory forof a domain.domain from Certificate Transparency: when certificates were issued and when the certificate changed.

Get historicalthe scansscan forhistory of a domain (with the total count and the scans, paginated). with page and limit.

GetList the recent scans of a domain and its subdomains, newest first, up to limit; status filters by scan status. Each row has matched_on: 'url' when the scan was submitted for a host under this domain, and only 'final_url' when another site redirected there. A verdict on a final_url-only row belongs to the submitted host, not to this domain.

Get summaryscan statisticscounts for a domain.domain: total, unique, completed and failed scans, first and latest scan, and scans in the last 24 hours, 7 days and 30 days.

Get favicon statistics.statistics across the archive: total favicons, those seen in the last 24 hours and the most common hashes with sample URLs. This aggregate query can take up to 90 seconds by default.

GetCheck whether the ScanMalware API healthis up. Returns the service status.

Get intrusion detection (IDS) alerts forraised on the network traffic recorded during one scan, with a scan_id.severity breakdown and total count. Empty when no rule fired. scan_id is the UUID of a ScanMalware scan.

Get statistics for an IP statisticsaddress (paginated).across the archive: total scans, unique URLs, first and last seen, geolocation, ASN and organisation, BGP and DNS data; paginated.

Get the JARM signaturesTLS server fingerprints measured for the hosts in one scan, with whether each matches a scan_id.known signature. A shared JARM often points to the same server software or hosting platform, so it is a weak pivot on its own. scan_id is the UUID of a ScanMalware scan.

Get JARM statistics.statistics across the archive, including the most common signatures. Common signatures usually belong to large hosting platforms.

Get Runtime JS Fingerprinter2Behaviour

Get JSthe Fingerprinter2runtime resultsJavaScript behaviour recorded for one scan: overall risk, risk scores, number of scripts, eval and Function-constructor calls and high-risk events, with a scan_id.behavioural signature and composite hash. include_detailed_events adds the individual events. scan_id is the UUID of a ScanMalware scan.

 ⟨5 unchanged words⟩ :true,"readOnlyHint":true,"title":"Get Runtime JS Fingerprinter2Behaviour"}

Get Runtime JS Fingerprinter2Analysis Coverage

Get JShow Fingerprinter2many fingerprintscans coverage.have runtime JavaScript fingerprints: coverage percentage and the number of unique composite hashes and signatures. Describes the service, not a scan.

 ⟨5 unchanged words⟩ :true,"readOnlyHint":true,"title":"Get Runtime JS Fingerprinter2Analysis Coverage"}

GetCheck Runtime JS Fingerprinter2Analysis Health

GetCheck JSwhether Fingerprinter2the healthruntime check.JavaScript analysis service is up, with its version.

 ⟨4 unchanged words⟩ openWorldHint":true,"readOnlyHint":true,"title":"GetCheck Runtime JS Fingerprinter2Analysis Health"}

Get Runtime JS Fingerprinter2Behaviour Stats

Get JSplatform-wide Fingerprinter2statistics stats.for runtime JavaScript analysis: risk distribution, averages and totals of eval calls and high-risk events. Describes the service, not a scan.

 ⟨5 unchanged words⟩ :true,"readOnlyHint":true,"title":"Get Runtime JS Fingerprinter2Behaviour Stats"}

GetList the JavaScript fingerprintsfiles a scanned page loaded, each with its fingerprint: hashes (SHA-256, SHA-1, MD5, normalized and fuzzy), size metrics, detected library and bundler. The include_* options add function lists, HTTP headers or ML vector details. Useful for collecting script hashes to search for elsewhere. scan_id is the UUID of a scan_id.ScanMalware scan.

GetList JSthe fingerprintJavaScript libraries and versions detected across the archive, with how many scans used each; library inventory.filters to one library and min_count drops rare versions. Identifiers are lowercase names such as 'react', 'jquery' or 'nextjs'.

GetList JSthe code segments for(functions and blocks) extracted from one scan's JavaScript, each with location, length, snippet and hashes; script_url narrows to one file, paginated with limit and offset. scan_id is the UUID of a scan_id.ScanMalware scan.

GetList suspiciousthe JSJavaScript code segments forfrom one scan scored as suspicious, above min_risk_score, with location, snippet and risk details; paginated with limit and offset. scan_id is the UUID of a scan_id.ScanMalware scan.

GetList unknownthe JSJavaScript code segments forfrom one scan that match no known library, at least min_code_length long; these are usually the page's own or a scan_id.kit's code. Paginated with limit and offset. scan_id is the UUID of a ScanMalware scan.

Get JSone JavaScript fingerprint record by ID.its numeric fingerprint_id: the script URL, scan, hashes, metrics and ML vector information; include_functions and include_http_headers add more detail.

Get JSstatistics fingerprinton bundlebundled statistics.JavaScript across the archive for a date range: share of bundled files and the breakdown by bundler (webpack, vite, rollup and so on) and module format.

GetFor JSeach fingerprintscript in one scan, report how common its hash prevalenceis foracross the archive, which separates widely used library files from rare, page-specific code. scan_id is the UUID of a scan_id.ScanMalware scan.

Get JSstatistics fingerprinton JavaScript library statistics.detection across the archive for a date range: total fingerprints, detection rate and the most common libraries.

Find JavaScript files whose fingerprint is similar JSto fingerprints.the one with this fingerprint_id, above threshold (0 to 1), paginated with limit and offset. exclude_same_scan drops matches from the same scan. Useful for finding variants of one script.

GetCount JShow fingerprintmany archived JavaScript files are similar to the one with this fingerprint_id, per similarity counts.model (composite, CodeBERT, GraphCodeBERT, AST and handcrafted features), capped at max_count. This query can take up to 90 seconds by default.

Get JSthe fingerprintstored source.source code of one JavaScript file by its numeric fingerprint_id, with its SHA-256, URL and length. Source can be long.

Get latestthe capabilitycurrent stats.size of ScanMalware's detection content: indicator count, malware detection rules and ClamAV signatures.

Get the malware detailsdetections for files the scanned page delivered, with threat names, detection counts and the detection source. Empty when nothing was detected. scan_id is the UUID of a scan_id.ScanMalware scan.

Get malware stats.detection statistics across the archive: overall and last-24-hour counts, top threats and hourly trend.

Get NetlogNetwork Log Info

 ⟨5 unchanged words⟩ :true,"readOnlyHint":true,"title":"Get NetlogNetwork Log Info"}

Get the text read by OCR datafrom forthe scan's screenshot, with language, confidence, word and character counts and any regions flagged as suspicious. Useful when page text is drawn as images. scan_id is the UUID of a scan_id.ScanMalware scan.

Get OCR stats.statistics across the archive: scans with OCR text, average confidence and length, language distribution and daily counts.

Get the Open Graph dataand forTwitter card metadata the scanned page declared (title, description, image, site name). Phishing pages often copy a scan_id.brand's metadata. scan_id is the UUID of a ScanMalware scan.

Get pastejacking findings for one scan: attempts by the page to replace what a scan_id.visitor copies, a common trick for making victims paste malicious commands. Includes a detected flag and a note. scan_id is the UUID of a ScanMalware scan.

GetDescribe the packet capture (PCAP) metadatarecorded forduring one scan: whether it exists, its size, compression and content type. The capture itself is not returned. scan_id is the UUID of a scan_id.ScanMalware scan.

Get platformthe statistics.current scan queue length, running scans and scans completed in the last 24 hours by visibility.

GetList popularthe most frequently detected web technologies over the last days (paginated).

Get RDAPregistration detailsdata (RDAP) for the scanned domain and its IP addresses: registrar, registration and expiry dates, domain age, nameservers and status. A very young domain is a scan_id.common phishing signal. scan_id is the UUID of a ScanMalware scan.

GetList the most recent public scans, newest first (paginated with page and limit). Each row has the scan ID, URL, status, visibility and submission time. Unlisted and private scans are never included.

Get recentList malware threats.threats detected in scans during the last hours (default window set by the API), with totals and grouping by threat.

Get recentList YARA threats.rule matches from scans in the last hours, each with the scan, URL, rule, category, severity and confidence.

Get safeGoogle browsingSafe Browsing threats found for the URLs in one scan, with a scan_id.has_threats flag. scan_id is the UUID of a ScanMalware scan.

Get safeGoogle browsingSafe stats.Browsing statistics across the archive: total threats, threats in the last 7 days, scans with threats and threat types.

GetCheck IOCone matchesscan foragainst threat-intelligence indicator feeds: matching IP addresses and domains the page contacted, the threat types, and a scan_id.summary of total and unique matches. scan_id is the UUID of a ScanMalware scan.

Get scanthe progress byof scan_id.a running scan: current step, total steps, step name, percentage and status. Useful for checking whether a scan has finished before reading its results. scan_id is the UUID of a ScanMalware scan.

GetList availablethe user reports and votes filed about one scan (for example marked safe or malicious), with the total count; report_type filters by kind. Empty when nobody has reported the scan. scan_id is the UUID of a scan_id.ScanMalware scan.

Get the full result document of one scan: resultURLs byand scan_id.redirects, page title, load times, links, network requests, IP addresses, JavaScript files, TLS, fuzzy hashes, screenshot hashes, favicon and the security verdict. The response is large; the compact summary is enough for a verdict. scan_id is the UUID of a ScanMalware scan.

Get a compact summary of one scan: summarysubmitted byURL, scan_id.final URL after redirects, status, completion time and the security verdict (verdict text, risk level, confidence and risk factors). Useful as the first look at a scan; the verdict is empty for a few seconds after a scan completes. scan_id is the UUID of a ScanMalware scan.

Get screenshot statistics.statistics across the archive: total screenshots, hash coverage and the distribution of perceptual hash types.

GetList detectedthe web technologies fordetected on a scan_id.scanned page (frameworks, CMS, CDN, analytics and so on), with versions where known. scan_id is the UUID of a ScanMalware scan.

GetList the technologies most often detected together with a given technology, combinationswith (paginated).counts; min_occurrences drops rare pairs; paginated.

Get technology stats.detection statistics across the archive: unique technologies, total detections and counts per category. This aggregate query can take up to 90 seconds by default.

Get the raw ASN.1 structure of the TLS certificate ASN.1from dataone scan, for detailed certificate inspection. scan_id is the UUID of a scan_id.ScanMalware scan.

Get the TLS detailscertificate forthe scanned site presented: subject, issuer, validity dates, whether it was valid or expired, and related details. scan_id is the UUID of a scan_id.ScanMalware scan.

GetList topthe tracking keys.and site keys seen on the most sites (analytics IDs, CAPTCHA keys and so on), with the tracker name, category and site count; tracker_type filters by kind.

Get YARA resultsrule matches for one scan, with a scan_id.summary by severity (critical, high, medium, low) and category. Empty when no rule matched. scan_id is the UUID of a ScanMalware scan.

Get the YARA rule matches recorded for one scan, with the matching rules and a scan_id.summary by severity and category. scan_id is the UUID of a ScanMalware scan.

Get YARA stats.statistics across the archive: overall and last-24-hour matches, severity and category distribution and top threats.

RunCompare JSthe differentialJavaScript analysisof forone scan against known libraries and report which code segments match a scan_id.library, which are unknown and which look suspicious, with a per-library breakdown. Matches below min_confidence (default 0.8) are not counted; known library code is excluded unless include_known_libraries is true. scan_id is the UUID of a ScanMalware scan.

SearchList scans whose AI scansanalysis bygave classification.a specific classification: LEGITIMATE, LOW_RISK, MODERATE_RISK, HIGH_RISK or CONFIRMED_SCAM. Each result has the URL, title, submission time and the analysis.

SearchList scans that the AI high-riskanalysis scans.rated high risk, optionally above min_risk_score and min_confidence, each with URL, title and the analysis. min_risk_score is on the AI's 0-10 risk scale (default 7) and min_confidence is a 0-100 percentage (default 70).

SearchList scans whose AI scansanalysis bynamed a given scam type.type, such as 'Phishing', each with URL, title, submission time and the analysis (verdict, classification, risk score). The match is on the scam type text the analysis produced.

SearchList scans that the security analyzer high-riskscored scansas high risk, highest first (paginated)., each with URL, risk score, verdict, confidence and analysis time. min_risk_score raises the threshold.

SearchGet scanswhat bythe ASNarchive knows about an autonomous system (paginatedASN number, without 'AS').: organisation, total scans, unique URLs, first and last seen and BGP prefixes; paginated.

SearchList scans bywhose page content has a similar fuzzy hash (paginatedhash_type tlsh, ssdeep or sdhash; the value comes from a scan result)., each with URL, title and time; paginated. Useful for finding near-identical copies of a page.

SearchList scans byof pages served from an IP address (paginated)., each with scan ID, URL and time. On shared hosting and CDNs an IP serves many unrelated sites, so a match is not evidence of a connection.

SearchList scans bywhose server presented this JARM signatureTLS fingerprint (paginated). Large hosting platforms share JARMs across many unrelated sites, so check what the matches have in common.

SearchList scansthe byscanned nameserver.domains that use a given nameserver, with totals and counts per top-level domain. Useful for finding domains registered together.

SearchList scans byof domains registered through a given registrar (paginated)., with the total. Common registrars match very many domains.

SearchList scans bywhose screenshot has this perceptual hash (paginatedhash_type ahash, phash, dhash, whash, color_hash or crop_resistant)., optionally within similarity_threshold, each with URL, title and time; paginated. Useful for finding pages that look the same.

SearchFind CPEsscans bywith a CPE identifier matching a pattern such as 'cpe:2.3:a:facebook:react' (paginated). Useful for finding sites running a given product.

SearchList scans whose favicon byhas this mmh3 hash (paginatedthe same convention as Shodan's http.favicon.hash)., each with the page URL, title and favicon details; paginated. Phishing kits often reuse one favicon across many hosts.

SearchFind JSJavaScript fingerprintsbundles bybuilt with a given bundler type.(webpack, vite, rollup, esbuild and so on), optionally by bundle format and detection confidence, with totals, format breakdown and average size; paginated with page and per_page.

SearchFind JSJavaScript fingerprintsserved byfrom CDN.a given CDN (for example 'cloudflare' or 'jsdelivr'), with totals, the top serving domains and cache status; unpinned_only keeps scripts loaded without a fixed version.

SearchFind JSJavaScript fingerprintsfiles bywhose fuzzy hash.hash is close to this one, above min_similarity, up to limit results. Fuzzy hashes match files that differ in small parts, such as a kit with a changed configuration.

Search JSFind fingerprintsscanned byJavaScript detected libraryas identifier,a suchgiven aslibrary (for example 'react', 'jquery' or 'nextjs'. The display name'nextjs'; 'Next.js' is accepted asfor an'nextjs'), aliasoptionally forone 'nextjs'.version or a version pattern, with a version breakdown and CDN distribution; paginated with page and per_page.

SearchFind JSscanned fingerprintsJavaScript bydetected as one exact library version, with the total and the matching scripts; include_deprecated and group_by_url adjust the results. Useful for finding sites running a vulnerable version.

SearchLook JSup fingerprintsa JavaScript file by MD5 hash.across the archive and report its prevalence: total matches, unique scans, first and last seen, a prevalence label and the matching scripts; include_scans adds the scans, from_date and to_date limit the period.

SearchLook JSup fingerprintsJavaScript by normalized hash.hash (computed after whitespace and formatting are removed, so reformatted copies still match) and report prevalence: total matches, unique scans, first and last seen and the matching scripts.

Search JSFind fingerprintsJavaScript by the type of web server type.that served it (for example 'nginx' or 'microsoft'), with the matching scripts; include_headers adds the HTTP headers. The total can be a lower bound.

SearchLook JSup fingerprintsa JavaScript file by SHA1SHA-1 hash.across the archive and report its prevalence: total matches, unique scans, first and last seen, a prevalence label and the matching scripts; include_scans adds the scans, from_date and to_date limit the period.

SearchLook JSup fingerprintsa JavaScript file by SHA256SHA-256 hash.across the archive and report its prevalence: total matches, unique scans, first and last seen, a prevalence label and the matching scripts; include_scans adds the scans, from_date and to_date limit the period. A rare hash shared by several phishing pages usually means one kit.

SearchList scanned JavaScript scored as obfuscated, JSfiltered fingerprints.by score range, classification and minimum code length; exclude_libraries drops known library code. min_score and max_score are obfuscation scores from 0 to 1 (defaults 0.7 and 1.0). Paginated with page and per_page.

Search JS fingerprints byList patterns.scanned SupplyJavaScript atfiles leastthat onematch booleancode-pattern filterfilters: has_eval, has_crypto, has_websocket, high_entropy, no_library and cdn_mismatch, orwhere cdn_mismatch.false Forselects example,files usewithout has_eval=true.the Explicitpattern falseand isfilters alsocan abe filter;combined. limitWith aloneno filter given, has_eval=true is notapplied. aEach filter.result has the fingerprint ID, scan, script URL, code length, obfuscation score and the patterns detected.

 ⟨30 unchanged words⟩ ":null,"title":"Has Eval"},"has_websocket":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":null,"title":"Has Websocket"},"high_entropy":{"anyOf":[{"type":"boolean ⟨29 unchanged words⟩ 

Search Runtime JS Fingerprinter2Behaviour by Composite Hash

SearchFind JSscans Fingerprinter2whose byruntime JavaScript behaviour has this composite hash.hash, each with the target URL, overall risk and time. The same composite hash across hosts usually means the same kit.

 ⟨5 unchanged words⟩ :true,"readOnlyHint":true,"title":"Search Runtime JS Fingerprinter2Behaviour by Composite Hash"}

Search Runtime JS Fingerprinter2Behaviour by Signature

SearchFind JSscans Fingerprinter2with bythis signature.behavioural signature (for example 'setTimeout:30|fetch:4|complex'), each with the target URL, overall risk and time. An uncached query can take up to 90 seconds by default.

 ⟨5 unchanged words⟩ :true,"readOnlyHint":true,"title":"Search Runtime JS Fingerprinter2Behaviour by Signature"}

SearchFind JSSimilar Fingerprinter2Runtime SimilarJS Behaviour

SearchFind JSscans Fingerprinter2whose runtime JavaScript behaviour is similar scans.to this scan's, above min_similarity; include_self keeps the scan itself. scan_id is the UUID of a ScanMalware scan.

 ⟨4 unchanged words⟩ openWorldHint":true,"readOnlyHint":true,"title":"SearchFind JSSimilar Fingerprinter2Runtime SimilarJS Behaviour"}

SearchList JSgroups malwareof families.scans Supplywhose min_cluster_sizeruntime JavaScript behaves alike (possible malware families), with clusters of at least 1min_cluster_size scans (default 2) orat similarity_threshold or above (0 to 1), or both;default limit0.95). aloneWhen isthe notservice ahas filter.clustering Forswitched exampleoff, usestatus min_cluster_size=2.is 'disabled' and no families are returned.

SearchList JSscans by the obfuscation signals.signals Supplytheir atruntime leastJavaScript oneshowed, ofnewest risk_levelanalysis first: overall risk, min_risk_scoremaximum and average risk score, oreval has_eval;and limitFunction aloneconstructor iscalls notand ahigh-risk filter.events. ForOptional example,filters useare has_eval=true.risk_level Explicit(such falseas and'high' aor 'critical'), min_risk_score of(0-100) 0and arehas_eval; validwith filters.none, the most recently analysed scans are listed.

SearchFind JScode segments bywith this exact code hash.hash across the archive, with the scans and scripts they appear in; paginated with limit and offset.

SearchFind JScode segments bywith this normalized hash.hash (formatting-independent) across the archive, with the scans and scripts they appear in; paginated with limit and offset.

SearchPaginated JSlist (limit and offset) of archived script fingerprints bybuilt with a given bundler, (paginated).each with scan, page URL and script URL.

SearchPaginated JSlist (limit and offset) of archived script fingerprints bywhose fuzzy hash (paginated).matches this value, each with scan, page URL and script URL. An empty list means no close match.

SearchPaginated JSlist (limit and offset) of archived script fingerprints bydetected as a given library, (paginated).each with scan, page URL, script URL and version.

SearchPaginated JSlist (limit and offset) of archived script fingerprints bydetected as one library version, (paginated).each with scan, page URL and script URL.

SearchPaginated JSlist (limit and offset) of archived script fingerprints bywith this MD5, (paginated).each with scan, page URL, scan time, script URL and hashes.

SearchPaginated JSlist (limit and offset) of archived script fingerprints bywith this normalized hash (paginatedformatting-independent)., each with scan, page URL and script URL.

SearchPaginated JSlist (limit and offset) of archived script fingerprints bywith SHA1this (paginated).SHA-1, each with scan, page URL, scan time, script URL and hashes.

SearchPaginated JSlist (limit and offset) of archived script fingerprints bywith SHA256this (paginated).SHA-256, each with scan, page URL, scan time, script URL and hashes.

Search OCRthe text read by OCR from scan screenshots for a pattern (paginated).; case_sensitive controls matching. Useful for finding pages that show the same lure text as an image.

Search the archive of public scans by text in the URL, domain or page title (qpaginated); mustq beneeds at least 3 characters and search_type narrows the match (default 'all'). Each result has the scan ID, URL, status, title, submission time and hosting ASN.

SemanticSearch searchscans overby scansmeaning rather than exact words, comparing the query with scanned page content (paginatedfor example 'bank login page asking for card details'). threshold (default 0.7) is the minimum similarity; an empty result means nothing was similar enough.

SearchFind scans that look like this one by screenshot similarity, favicon or fuzzy page hash (methods, default screenshot), each with URL, final URL, title and what it matched by; paginated. Useful for scansfinding similarcopies toof a phishing page on other hosts. scan_id (paginated).is the UUID of a ScanMalware scan.

SearchFind forscreenshots similarwithin screenshotsmax_distance by(Hamming hash.distance, default 3) of an integer perceptual hash (hash_type, default phash), each with scan, URL, title, distance and similarity score.

SearchList scans where the page wrote suspicious clipboardcontent indicatorsto the clipboard (paginatedfor example PowerShell commands)., each with URL, event count, reason and time; pattern filters the content; paginated.

Search the web technologies detected across the archive by name (paginatedq). or category, each with how many scans used it and when it was last seen; paginated.

SearchFind byscans that embed a given tracking or site key, such as an analytics ID or a CAPTCHA site key (paginatedtracker_type and key)., sorted latest or oldest; paginated. A shared key often ties sites to one operator.

PollWait untilfor a submitted scan reachesto afinish terminalby polling its status every poll_interval_s seconds, returningup to timeout_s seconds (default 180). Returns the final summary.compact summary (URL, final URL, status, completion time and the security verdict), or the last known status with timeout set to true if the scan is still running. scan_id is the UUID of a ScanMalware scan.

Get JS fingerprint similarity counts. This query can take up to 90 seconds by default.

Search scans by favicon hash (paginated).: a mmh3 hash by default, or the favicon's MD5 with hash_type='md5'.

Search JS fingerprints by detected library name. Use identifiers from get_js_library_inventoryidentifier, such as 'react', 'jquery' or 'nextjs'. The display name 'Next.js' is accepted ⟨5 unchanged words⟩ 

Search JS Fingerprinter2 by signature. An uncached query can take up to 90 seconds by default.

 ⟨15 unchanged words⟩ query can take up to 90 seconds by default; allow it to finish before retrying.default.

Submit a URL to ScanMalware forto scanning.be WARNING:rendered scan_typeand defaultsanalysed toin 'public',a whichsandboxed publishesbrowser; returns the targetnew URLscan_id. scan_type is required and scansets resultswho incan see the publicresult: feed'public' andlists makesthe themURL visibleand toits otherresults usersin andthe searchpublic engines.feed, Choosevisible visibilityto explicitly:anyone 'public'and publishesto thesearch scan;engines; 'unlisted' keeps itthe scan out of public listings, but anyone with the directits link can accessopen it; 'private' restrictslimits resultsthe result to the authenticated ScanMalware account and requiresof this server's SCANMALWARE_BEARER_TOKEN toand beis configured.rejected Forwhen clientno targets,token confidentialis URLs,configured. orWraps securityPOST engagements,/api/v1/scan askof the user to choose 'unlisted' or 'private' unless they have already specified visibility; use 'public' only with explicit approval to publish. Never fall back to a less restrictiveScanMalware visibilityAPI, ifdocumented submissionat fails.https://scanmalware.com/api-docs.

 ⟨11 unchanged words⟩ ,"title":"Options"},"scan_type":{"default":"public","enum":["public","unlisted","private"] ⟨19 unchanged words⟩ :"User Agent"}},"required":["url","scan_type"],"title":"submit_scanArguments","type":"object"}

SubmitVote on a scan, report.as the Mark as Safe and Mark as Malicious buttons on its result page do: report_type 'positive_feedback' marks the scanned page as safe and 'malware' marks it as malicious. report_details is an optional note of up to 1000 characters. Votes are recorded as crowd feedback on the scan and are rate-limited per client IP. The website's other report types (phishing, spam, copyright and so on) need a captcha and are not available here.

{"properties":{"captcha_answer":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Captcha Answer"},"captcha_tokenreport_details":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"CaptchaReport TokenDetails"},"report_detailsreport_type":{"anyOfenum":[{"type":"stringpositive_feedback"},{"type":"nullmalware"}],"default":null,"title":"Report Details"},"report_type":{"title":"Report Type","type":"string"},"scan_id":{"title":"Scan Id","type":"string"},"skip_captcha":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":null,"title":"Skip Captcha"},"user_agent":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"User Agent"},"x_forwarded_for":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"X Forwarded For"},"x_real_ip":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"X Real Ip"}},"required":["scan_id","report_type" ⟨4 unchanged words⟩ 

Search JS malware families. Supply min_cluster_size (at least 1) or similarity_threshold (0 to 1), or both; limit alone is not a filter. For example, use min_cluster_size=2.

Search JS obfuscation signals. Supply at least one of risk_level, min_risk_score, or has_eval; limit alone is not a filter. For example, use has_eval=true. Explicit false and a min_risk_score of 0 are valid filters.

Search OCR text (paginated). q must contain at least 3 characters after trimming. This query can take up to 90 seconds by default; allow it to finish before retrying.

Submit a URL to ScanMalware for scanning. WARNING: scan_type defaults to 'public', which publishes the target URL and scan results in the public feed and makes them visible to other users and search engines. Choose visibility explicitly: 'public' publishes the scan; 'unlisted' keeps it out of public listings but anyone with the direct link can access it; 'private' restricts results to the authenticated ScanMalware account and requires this server's SCANMALWARE_BEARER_TOKEN to be configured. For client targets, confidential URLs, or security engagements, ask the user to choose 'unlisted' or 'private' unless they have already specified visibility; use 'public' only with explicit approval to publish. Never fall back to a less restrictive visibility if submission fails.

 ⟨13 unchanged words⟩ },"scan_type":{"default":"public","enum":["public","unlisted","private"],"title":"Scan Type","type":"string" ⟨22 unchanged words⟩