Malicious URL Scanner API Documentation

URL Scanner API for Malicious URLs

IPQualityScore's Malicious URL Scanner API scans links in real-time to detect suspicious URLs. Accurately identify phishing links, malware URLs and viruses, parked domains, and suspicious URLs with real-time risk scores. Industry leading phishing detection and domain reputation provide better signals for more accurate decision making.

Scan URLs for malware to detect poor reputation domains, suspicious links, and phishing URLs with a real-time API that can be integrated directly into your site, SOAR, or other third party software. Accurately check URLs for malware without false-positives or missed hit rates. Take URL intelligence a step further with parking domain detection and support to identify domains used for email spam. Easily enhance your SIEM/SOAR platform intelligence with our URL Threat Scanning API. Classify websites with over 70 website categories for easier analysis of unknown sites.

Malicious URL Scanner Use Cases

• Phishing URL Detection — Detect malicious URLs used for phishing campaigns and misleading advertising.
• Malicious URL Scanning — Identify URLs used for malware and viruses with live threat intelligence feeds that detect zero-day phishing links and suspicious behavior.
• Parked Domain Detection — Detect parked domains and easily classify parked domains via API such as ParkingCrew, Sedo, Bodis, Skenzo, ParkLogic, Rook Media, Voodoo, and recognition for all types of parked domains.
• Telecom Abuse — Screen text messages, SMS, and user messages in real-time to detect phishing, malicious links, affiliate spam, and other abuse.
• Filter Email Spammer Domains — Sift through suspicious emails with detection for domains confirmed as sending email SPAM. Further validate SPAM with real-time email threat scoring.
• Abusive Domains - Block emails from disposable email services and throwaway accounts. Pair with IP reputation checks for deeper insight.

Malicious URL Checker API

Detect malicious sites with live URL scanning via on-demand API requests. Simply call our API from your SOAR, backend, or other third party service to retrieve accurate risk scores. Detect scam sites, phishing, malware, and low reputation domains used for fraudulent behavior. Parked domain detection is also supported. The API only requires a valid URL and will perform over 20 data points in return to summarize the risk level associated with the URL or domain.

Phishing Detection API

Stop phishing with real-time protection against malicious URLs. Detect zero-day phishing links and newly setup domains, even before other services have had a chance to analyze the URL. The IPQS machine learning phishing detection API ensures any threat will be accurately classified. Use the "phishing" boolean data point and "risk_score" to identify confirmed phishing links. Additionally, classify domains and URLs into website categories such as "search engine", "ecommerce", "business", etc. Accurately detect phishing domains and malicious URLs.

Domain Reputation API

Analyze domain risk scores in real-time with deep insights from the IPQS domain reputation API. Accurately identify newly created domains and malicious domains associated with high risk behavior such as phishing links, spam, fake accounts, or hosting malware. Receive over 25 data points for any domain with intelligent data that improves real-time decision making. Access the best blacklists and machine learning technology that makes it challenging for bad actors to operate online.

Parked Domain Detection API

Quickly check parked domains and placeholder websites, common patterns for malicious websites and links. Lookup parked domains in real-time to verify if the domain name is currently pointed to a popular parked domain service such as Sedo, ParkingCrew, and many others. Machine learning models also detect private parking domain networks and custom landing pages.

Private Key

NOTE: Do not share this key with anyone. It's like a password and can be used to make queries using our API.

Request URLs

The URLs below can be used to fetch the result using cURL or another utility in most languages. Please see the usage example at the bottom of the page. Simply replace "URL_HERE" with the URL to scan.

JSON Example Requests

JSON Success Response Example

NOTE: For a description of each field listed above please consult the response documentation below.

XML Success Response Example

NOTE: For a description of each field listed above please consult the response documentation below.

JSON Error Response Examples

Example errors that you may encounter when accessing our API due to an exhausted credit balance or an invalid URL.

Additional Request Parameters

Custom tracking variables (such as "userID", "transactionID") established in your account settings can be passed with each API request. This allows our reporting tools to filter by specific users, products, campaigns, transactions, etc. so that you can easily match up records with your own system to identify fraudulent activity.

Additional Request Options

Due to the nature of platform requirements or frameworks it may be necessary to request IPQS API endpoints without passing the API key in the URL. As an alternative, IPQS allows the API key to be passed via GET, POST, or Headers. These requests use the following endpoints:

Method	Value	Example
GET	key	?key=YOUR_API_KEY_HERE&url=https%3A%2F%2Fgoogle.com
POST	key	key=YOUR_API_KEY_HERE&url=https%3A%2F%2Fgoogle.com
Header	IPQS-KEY (Additional parameters passed as either GET or POST)	IPQS-KEY: YOUR_API_KEY_HERE

Response Field Definitions

Quick Notes

• Risk Scores >= 75 - suspicious - usually due to patterns associated with malicious links.
• Suspicious URLs marked with Suspicious = "true" will indicate domains with a high chance for being involved in abusive behavior.
• Risk Scores >= 90 - high risk - strong confidence the URL is malicious.
• Risk Scores = 100 AND Phishing = "true" OR Malware = "true" - indicates confirmed malware or phishing activity in the past 24-48 hours.

Further Details on URL Scanning API Results

The Malicious URL Scanner API returns many data points so your business logic can make the best decisions for your audience. Analyzing the overall Risk Score is usually the best way to determine domain reputation and the overall scoring confidence level. When this value is 100, there is 100% confirmed activity of phishing, malware, or similar abuse. Suspicious URLs can be identified with the "suspicious" data point, or by analyzing Risk Scores 30 - 80. URLs or domains with Risk Scores >= 85 are suspicious and likely to be a poor reputation domain or malicious URL.

Risk Scores >=90 have been classified by our deep machine learning as suspected of phishing, malware activity, or similar type of abuse. Risk Scores = 100 will provide confirmation the URL is accurately classified as a malicious link.

We recommend blocking or flagging a URL as malicious using a combination of the "risk_score", "phishing", "malware", "suspicious", "parking", and "spamming" variables.