urlscan.io is a web sandbox and URL-analysis service. When you provide a URL, it loads the page in a headless browser, mimicking a real user visit, and captures a full snapshot: the page HTML/DOM, network requests (IPs, domains), loaded resources (JavaScript, CSS), cookies, and a screenshot.
It helps you inspect unknown or suspicious websites safely — ideal for spotting phishing, malicious scripts, hidden redirects, or suspicious infrastructure. That’s valuable for security analysts, threat investigators, or anyone verifying links (e.g. before clicking or embedding). As phishing and malicious-URL threats grow, having a detailed, sandboxed preview reduces risk and aids quick triage.
- You submit a URL (via web UI or API).
- urlscan.io runs a headless browser (Chrome) to fetch the page.
- It records everything — HTML/DOM, network activity (IPs, domains, requests), cookies, loaded scripts/styles, final redirects — then stores a screenshot and full DOM snapshot.
- It also runs detection heuristics: if the site imitates any of the many brands it tracks, or exhibits suspicious characteristics (phishing, spoofing, malicious JS), it flags that.
