Skip to content
API Endpoints/Malicious/
Malicious observable look...

Malicious observable lookup

Request

urlscan Pro - Look up how often an observable has been seen in malicious scan results, along with first and last seen timestamps.

The type parameter selects what kind of observable to query:

  • ip — Match scans by the IP address of the page server (e.g. 192.0.2.1).
  • hostname — Match scans by the exact page hostname (e.g. www.example.com). Use this when you are interested in a specific host.
  • domain — Match scans by the apex (registered) domain (e.g. example.com). This covers all subdomains under that domain, so a lookup for example.com will include scans for www.example.com, blog.example.com, etc. Use this for a broader view across an entire domain.
  • url — Match scans by the exact page URL. The value must be URL-encoded (e.g. https%3A%2F%2Fexample.com%2F).
Security
apikeyAuth(Required scopes: readwrite)
Path
typestringrequired

The type of observable to look up.

Enum:"ip""hostname""domain""url"
valuestringrequired

The observable value. Format depends on type:

  • ip: an IP address (e.g. 192.0.2.1)
  • hostname: a fully qualified hostname (e.g. www.example.com)
  • domain: an apex/registered domain (e.g. example.com)
  • url: a URL-encoded URL (e.g. https%3A%2F%2Fexample.com%2Fpath)
GET
/api/v1/malicious/{type}/{value}
curl -i -X GET \
  'https://urlscan.io/api/v1/malicious/{type}/{value}' \
  -H 'api-key: YOUR_API_KEY_HERE'

Responses

Successful response

Bodyapplication/json
observablestring

The observable that was looked up.

typestring

The type of observable.

Enum:"ip""hostname""domain""url"
countinteger

Number of times this observable has been seen in malicious scan results.

firstSeenstring or null, (date-time)

Timestamp when this observable was first seen in malicious scan results.

lastSeenstring or null, (date-time)

Timestamp when this observable was last seen in malicious scan results.

Response
{
  "observable": "string",
  "type": "ip",
  "count": 0,
  "firstSeen": "2019-08-24T14:15:22Z",
  "lastSeen": "2019-08-24T14:15:22Z"
}