URLScan.io Analysis

curl -X POST https://api.dfir-lab.ch/v1/phishing/urlscan \
  -H "Authorization: Bearer sk-dfir-your-key-here" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": [
      "https://suspicious-login.com",
      "https://another-url.net"
    ]
  }'

import requests

response = requests.post(
    "https://api.dfir-lab.ch/v1/phishing/urlscan",
    headers={
        "Authorization": "Bearer sk-dfir-your-key-here",
        "Content-Type": "application/json",
    },
    json={
        "urls": [
            "https://suspicious-login.com",
            "https://another-url.net",
        ]
    },
    timeout=60,  # 45s shared scan budget plus request overhead
)

response.raise_for_status()
data = response.json()
for result in data["data"]["results"]:
    verdict = (result.get("verdicts") or {}).get("overall") or {}
    if verdict.get("malicious") is True:
        status = "POTENTIAL THREAT"
    elif result.get("state") == "complete" and result.get("risk") == "no_known_threats" and not result.get("error") and verdict.get("malicious") is False and verdict.get("score") == 0:
        status = "NO KNOWN THREATS — safety unverified"
    else:
        status = "UNKNOWN OR SUSPICIOUS — inspect evidence"
    print(f"{result['url']}: {status}")
    # Do not log URLs or private scan IDs in production telemetry.

const response = await fetch(
  "https://api.dfir-lab.ch/v1/phishing/urlscan",
  {
    method: "POST",
    headers: {
      Authorization: "Bearer sk-dfir-your-key-here",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      urls: [
        "https://suspicious-login.com",
        "https://another-url.net",
      ],
    }),
    signal: AbortSignal.timeout(60_000),
  }
);

if (!response.ok) throw new Error(`HTTP ${response.status}`);
const { data, meta } = await response.json();

for (const result of data.results) {
  const overall = result.verdicts?.overall;
  const status = overall?.malicious === true ? "POTENTIAL THREAT"
    : result.state === "complete" && result.risk === "no_known_threats" && !result.error && overall?.malicious === false && overall?.score === 0
      ? "NO KNOWN THREATS — safety unverified" : "UNKNOWN OR SUSPICIOUS";
  console.log(
    `${result.url}: ${status}`,
    `(score: ${overall?.score ?? "unavailable"})`
  );
  // Keep private scan IDs and URLs out of production logs.
}

console.log(`Credits used: ${meta.credits_used}`);