Security Scanner checks URLs, domains, IP addresses, and file hashes against dozens of threat intelligence sources at once. Get a clear verdict on whether something is malicious, phishing, or suspicious — in seconds, without logging into multiple dashboards.
It covers the full range of security checks developers and IT teams need: threat lookups, TLS certificate inspection, security header audits, and full vulnerability scans. A single security_report call runs everything and comes back with a risk score.
What you can do
- Check any URL against 70+ antivirus and threat engines
- Look up domains for malware, phishing, and threat intelligence flags
- Check IP addresses for abuse reports and threat actor associations
- Verify file hashes to detect known malware samples
- Probe hosts for HTTP security headers and TLS configuration
- Scan for vulnerabilities and generate a scored risk report
Who it's for
Developers who want to audit their own domains before launch. Security teams triaging suspicious links or IPs. SaaS builders who need to validate user-submitted URLs. Anyone who needs a quick, multi-source threat verdict without switching between tools.
How to use it
- For a full audit, use security_report — it runs all checks in one go and returns a risk score with prioritized findings
- For targeted checks, use check_url, check_domain, check_ip, or check_hash individually
- Use probe_hosts to inspect HTTP headers and TLS on any domain
- Use scan_targets for vulnerability scanning — note this runs async and takes around 60 seconds
Getting started
Connect your VirusTotal account for full threat intelligence coverage. AbuseIPDB adds community abuse reports on IP checks. Both are optional — threat feeds from URLhaus and ThreatFox run without any API key.
