urlscan-api

Submit URLs to the URLScan.io API and retrieve scan results.

15|5|Updated Apr 6, 2026
One-click install
npx skills add https://github.com/Liberty91LTD/cti-skills --skill urlscan-api
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: urlscan-api
Source: https://github.com/Liberty91LTD/cti-skills/tree/main/skills/urlscan-api
Command: npx skills add https://github.com/Liberty91LTD/cti-skills --skill urlscan-api

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Submits URLs to URLScan.io for automated scanning and retrieves structured results, enabling rapid assessment of URL safety.

Core Features & Use Cases

  • Submitting URLs for asynchronous scanning via the API.
  • Retrieving scan results including verdicts, final URL, and hosting details.
  • Use Case: Incident response, threat hunting, and automated URL reputation workflows.

Quick Start

Submit a URL to the API and inspect the returned scan data.

Frequently Asked Questions about urlscan-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate URL submission to URLScan.io for threat intelligence workflows?

You can submit URLs asynchronously to the URLScan.io API to retrieve structured scan data for threat intelligence workflows. This automated URL submission returns fields like page.ip, page.country, and lists.domains for rapid assessment.

What data fields are available when retrieving URLScan.io scan results?

Retrieving URLScan.io scan results provides fields such as verdicts.overall, page.url, page.ip, page.country, lists.domains, lists.urls, and task.screenshotURL. These scan results enable quick evaluation of URL safety during incident response.

Can I integrate URL reputation checks into an incident-response pipeline using asynchronous scanning?

Yes, you can integrate URL reputation checks into an incident-response pipeline using asynchronous API submission. The process submits URLs for scanning and retrieves hosting details and verdicts, supporting automated workflows across security investigations.

Does URLScan.io API support threat hunting for suspicious domains and URLs?

URLScan.io API supports threat hunting by returning lists.domains and lists.urls fields in scan results. Threat hunters use these structured scan outputs alongside page.country and page.ip data to investigate suspicious hosting infrastructure.

What is the best way to fetch URL safety verdicts for automated URL scanning?

The best way to fetch URL safety verdicts is submitting a URL to the API and retrieving the returned verdicts.overall field. Automated URL scanning uses asynchronous submission endpoints to generate final URL details and hosting information.

Why does asynchronous URL submission return different final URL data than expected?

Asynchronous URL submission returns final URL data reflecting server-side redirects, captured in the page.url field. The scan results also include page.ip and page.country, which may differ from initial inputs due to redirect resolution during scanning.