Search Scans

datedateDatetime of when the scan was performed
asnkeywordAny of the AS numbers that were contacted (e.g. AS123)
asnnametextAny of the AS Names that were contacted
asnname.keywordkeywordAny of the AS names that were contacted (analysed as keyword)
canonical.page.urlkeywordCanonicalized version of the page URL
canonical.task.urlkeywordCanonicalized version of the task URL
countrykeywordISO 3166-1 2-letter country code of any country that was contacted
domaindomainAny domain and subdomain that was contacted
domain.keywordkeywordAny domain and subdomain that was contacted
filenametextAny URL that was requested
filename.keywordkeywordAny URL that was requested
hashkeywordAny SHA256 hash of any HTTP response
ipipAny IP that was contacted
serverkeywordAny HTTP "Server" header of subrequests
page.apexDomainkeywordApex domain of the page
page.apexDomainAgeDaysintegerAge of the page apex domain in days
page.asnkeywordAS Number of the website
page.asnnametextName of the main AS of the website
page.countrykeywordPrimary IP GeoIP Country (ISO 3166-1 2-letter country code)
page.domaindomainPrimary Domain (Analysed as all levels of parent domains)
page.domain.keywordkeywordPrimary Domain (Analysed as keyword)
page.domainAgeDaysintegerAge of the page domain (hostname) in days
page.ipipPrimary IP
page.languagekeywordISO-639 language code based on page text
page.mimeTypekeywordMIME type of the primary HTTP response
page.ptrdomainDNS PTR record of primary IP
page.redirectedkeywordWhether the page was redirected from task.url, can be one of same-domain, sub-domain, off-domain, https-only
page.servertextHTTP "Server" header of primary request
page.statuskeywordHTTP status code of primary request response
page.titletextTitle of the page
page.title.keywordkeywordTitle of the page
page.tlsAgeDaysdateAge of TLS certificate when the page was scanned (in days)
page.tlsIssuerkeywordIssuer of the page TLS certificate
page.tlsValidDaysdateTLS certificate validity period in days
page.tlsValidFromdateTLS certificate Valid-From date
page.umbrellaRankintegerCisco Umbrella Top 1 Million rank of page domain
page.urltextURL of the primary page (after redirection)
page.url.keywordkeywordURL of the primary page (after redirection, analysed as keyword)
stats.dataLengthintegerData size of all subresources
stats.encodedDataLengthintegerTransfer size of all subresources
stats.requestsintegerNumber of subrequests
stats.uniqCountriesintegerNumber of unique countries contacted
stats.uniqIPsintegerNumber of unique IPs contacted
task.apexDomainkeywordApex domain of the tasked hostname
task.domaindomainDomain of the tasked URL
task.domain.keywordkeywordDomain of the tasked URL (analysed as keyword)
task.methodkeywordCan be manual, api, or automatic
task.sourcekeywordExamples: phishtank or certstream-suspicious
task.tagskeywordUser-defined tags supplied during scan submission
task.urltextThe original URL that was tasked
task.url.keywordkeywordThe original URL that was tasked (analysed as keyword)
task.uuidkeywordThe unique UUID of the scan
task.visibilitykeywordCan be one of public, unlisted, or private
uservirtualScans submitted by yourself (Can only be me)
teamvirtualScans submitted by any of your teams (Can only be me)
apikeyvirtualScans submitted using one of your API keys (Can only be me)
files.sha256keywordSHA256 of file downloaded by the website
files.filenamekeywordFilename of file downloaded by the website
files.filesizeintegerFilesize of file downloaded by the website
files.mimeTypekeywordMIME type description of file downloaded by the website
brand.countrykeywordProISO 3166-1 2-letter country code of the brand
brand.keykeywordProUnique key of the brand
brand.nametextProName of the brand
brand.verticaltextProIndustry vertical of the brand, e.g. "banking"
content.cookieNameskeywordProNames of cookies set by page
content.globalNameskeywordProNames of non-standard JavaScript global variables
content.inputNameskeywordProName attributes of input fields on page
content.inputTypeskeywordProType attributes of input fields on page
content.storageNameskeywordProNames of items in localStorage and sessionStorage set by page
content.technologieskeywordProNames of technologies detected according to Wappalyzer
dom.contentkeywordProRaw content of DOM snapshot, truncated to the first 100kB - Careful: Slow to search
dom.hashkeywordProSHA256 hash of the DOM before truncation
dom.sizeintegerProSize of the DOM before truncation
frames.domainsdomainProDomains of frames
frames.lengthintegerProNumber of frames
frames.urlskeywordProURLs of frames / iFrames
links.domainsdomainProDomains of outgoing links
links.lengthintegerProNumber of outgoing links
links.urlskeywordProURLs of outgoing links (to different domains than page.domain)
scanner.countrykeywordProScanner IP exit location (ISO 3166-1 2-letter country code)
image.aspectratiofloatProAspect ratio of screenshot (width / height)
image.hashintegerProSHA256 hash of screenshot
image.heightintegerProHeight of screenshot in pixels
image.sizeintegerProSize of screenshot in bytes
image.widthintegerProWidth of screenshot in pixels
submitter.countrykeywordPro GeoIP country of the submission IP (ISO 3166-1 2-letter country code)
text.contenttextProVisible text on the website, truncated to the first 20kB
text.hashkeywordProSHA256 hash of the text before truncation
text.sizeintegerProSize of the text content before truncation
verdicts.maliciousbooleanProWhether a verdict exists for the page
verdicts.engines.maliciousbooleanProML malicious verdict
verdicts.engines.scoreintegerProML score from -100 to 100
verdicts.urlscan.maliciousintegerProThe urlscan malicious verdict
verdicts.community.maliciousintegerProThe community verdict for a scan
verdicts.scoreintegerProMaliciousness score of page from -100 (benign) to 100 (malicious)
verdicts.lastVerdictdateProDate the latest verdict for this scan was added, only for verdicts created after the scan has finished
visible.brandnametextProBrand name the website claims to represent (urlscan Brand AI)

Help & Examples
Attention: Consult the Search API Reference for searchable fields and additional tips.

  • Search requests (through the UI or API) are subject to your individual Search API Quotas. Make sure to use your API key.
  • The query field uses the ElasticSearch Query String to search for results.
  • All queries are run in filter mode, sorted by date with the more recent scans first. There is no scoring of search results.
  • You can group and concatenate search-terms with brackets
    ( )
    ,
    AND
    ,
    OR
    , and
    NOT
    . The default operator is
    AND
    .
  • You can concatenate terms within a group, e.g.
    page.domain:(foo.com OR bar.com)
    .
  • Always use the field names of the fields you want to search. Wildcards for the field-name are not supported! Field names are case sensitive!
  • Always escape reserved characters with backslash:
    + - = && || > < ! ( ) { } [ ] ^ " ~ * ? : \ /
  • Limit the time-range if possible using
    date
    , e.g.
    date:>now-7d
    or
    date:>now-1y
    .
  • The
    date
    allows relative queries like
    date:>now-7d
    or range-queries like
    date:[2020-01-01 TO 2020-02-01]
    or both combined.
  • You can only use leading wildcard searches and regular expression searches on supported fields, and only as a signed-in user.
  • Everything is indexed as lowercase, even if the Search API returns values in a case-preserving manner.
  • Regular expressions are always anchored to beginning/end of the tokens (implicit ^ and $). Make sure to prefix/suffix with
    .*
    to match infix strings.
  • Domain fields contain the whole domain and each smaller domain component, i.e.
    domain
    can be searched by google.com which will find hits for www.google.com

Examples - Common searches and multiple query terms combined

Search results (100 / 10000+

URL
siimshop.ir/
kaabadealstravel.com.noumannasir.com/
www.booster-t.site/
t5yis-fiaaa-aaaan-qznla-cai.icp0.io/index.html
bld02n0s.beget.tech/
comparative-apricot-xwwnmne964-zol2bgha9a.edgeone.app/
jaexd-hqaaa-aaaah-qpuoq-cai.icp0.io/
w54ug-laaaa-aaaai-q3kqq-cai.icp0.io/index.html
www.sendregning.no/
fh6.wpenginepowered.com/ca3/cal.php
cpcontacts.wdh.ote.mybluehost.me/
57383nvb.click/
www.glensargent.com/
riohealthcongress.com.br/
excalidraw.chn.tf/
jp118slot.org/
update-tomtom-xxl.pages.dev/
www.picso.ai/
jp118slot.org/
www.juliogavazza.com/
mail.wcsswitzerland.ch/
thekfandomstore.pages.dev/KOITOTO/
spiludenomrofus.co.com/
i39.sekhemonline.net/
expera.ge/
www.pacificfireplaceservice.com/
ligabola288.com/tempt1/sega333.org/
www.smartechsecurity.co.uk/
bboilrf.com/
envirowhizz.com/
grynxrubber.com/project/1100-20/contact.html
www.inbank.ro/
prospectshired.com/
login.microsoftonline.com/a8037933-4d29-4ef8-8754-e67b2edd480b/oauth2/authorize...
xanhterra.com/
www.bxe.ote.mybluehost.me/
www.aboveden.com.shacoben.space/
nuevo.aiguadiscoteca.es/
zafytf5y8w.031527dhxl1.top/demo/
app.2peuples2etats.info/
whistlingtree3.com/.well-known/acme-challenge/VR/Login.html
i0k7山青花欲燃.45660812.com/fallback/ IDN
rental-billing-manager.pages.dev/
kristeen.kristeen.theperfectpocketbook.com/
68660.xyz/
www.afternic.com/forsale/ssfactory.com?utm_source=TDFS_DASLNC&utm_medium=parked...
architektur-energieeffizienz.de/
minds.recapro.es/
www.brabantsewaterschapsverordening.nl/
www.xpjoo.com/
evernote.com/online-notepad
jp118slot.org/
gacor148.com/
www.ichbinfrau.de/
bet447.cc/
lesjardsdumarais.spahotel.guru/
sec.indagolabs.com/app/login?
moz.com.py/
www.xpjaa.com/
www.betoooo.com/
obrhubr.org/
webcast-govdelivery.com/
www.barbarahof.at/
evil.com/login.xyz
www.paypal.com/signin
drk-row.de/
accounts.evernote.com/login
bet447.cc/
esaymanager-lorentz-lolpop.nagelstudio-adriana.de/Idiosyncratic/?456TY280YU=45V...
tr-1161jojobet.com/
www.dinheironaplanta.com.br/
bxe.ote.mybluehost.me/
apnaghargovt.pk/
web-proton-mail.weebly.com/
bit.ly/12345xyz
fidelityinsgroup.com/
danaa-indonesiaa4.resmi-mil.my.id/
sport.spahotel.guru/
lussosaigonworldhotel.com/
hospital.ikshadigitals.com/
176.65.139.59/hiddenbin/boatnet.x86
www.jugov.ch/
ascow.spahotel.guru/
serwis.edziecko.edu.pl/
mailchimp.com/about/mcsv-static
mailchimp.com/about/mcsv-static
dgbadcbadvzlnnfree-premium-accounts-filehosts.appartements-serfaus.at/
pwood.spahotel.guru/
3-globe-table-lamp.pages.dev/
www.claimsale.ai/
czerwonykamienzabawa.pl/
mebanks.com.x.macks.com/
dpd.deliverytrackingnow.cfd/update/
reliable-mail.com/
ww17.j251107_23.zpollich.com/init.txt
satishlalacharya.online/
paralelaonline.com.br/zv/webmail/
94.203.46.18/poc.jsp/
scalemenstudio.digital/
mybooking.cbbwvexcqoguiweb.jfhmcc88.com/

(10000 results in total, 100 shown)