IPQS
Login Register
<< Back to Categories
Getting Started

About the Malicious URL Scanner API

The IPQS Malicious URL Scanner API scans links in real time to detect suspicious URLs. Accurately identify phishing links, malware URLs and viruses, parked domains, and suspicious URLs with real-time risk scores. Industry-leading phishing detection and domain reputation provide better signals for more accurate decision-making.

Scan URLs for malware to detect poor reputation domains, suspicious links, and phishing URLs with a real-time API that you can integrate directly into your site, SOAR, or other third-party software. Accurately check URLs for malware without false positives or missed hit rates. Take URL intelligence a step further with parking domain detection and support to identify domains used for email spam. Quickly enhance your SIEM/SOAR platform intelligence with our URL Threat Scanning API. Classify websites with over 70 website categories for easier analysis of unknown sites.

You can test out the IPQS malicious URL scanner using our free tool.

Instructions for using the Malicious URL scanner API can be found below.

Phishing Detection API

Stop phishing with real-time protection against malicious URLs. Detect zero-day phishing links and newly set-up domains even before other services have had a chance to analyze the URL. The IPQS machine learning phishing detection API ensures any threat will be accurately classified. Use the phishing data point and risk_score to identify confirmed phishing links. Additionally, classify domains and URLs into website categories such as "search engine", "e-commerce", "business", and more. Accurately detect phishing domains and malicious URLs.

Domain Reputation API

Analyze domain risk scores in real time with deep insights from the IPQS domain reputation API. Accurately identify newly created domains and malicious domains associated with high-risk behavior such as phishing links, spam, fake accounts, or hosting malware. Receive over 25 data points for any domain with intelligent data that improves real-time decision-making. Access the best blocklists and machine learning technology to make it challenging for bad actors to operate online.

Parked Domain Detection API

Quickly check parked domains, placeholder websites, and common patterns for malicious websites and links. Look up parked domains in real-time to verify if the domain name is currently pointed to a popular parked domain service such as Sedo, ParkingCrew, and many others. Machine learning models also detect private parking domain networks and custom landing pages.

Malicious URL Scanner API Use Cases

  • Phishing URL Detection: Detect malicious URLs used for phishing campaigns and misleading advertising.
  • Malicious URL Scanning: Identify URLs used for malware and viruses with live threat intelligence feeds that detect zero-day phishing links and suspicious behavior.
  • Parked Domain Detection: Detect parked domains and easily classify them via APIs such as ParkingCrew, Sedo, Bodis, Skenzo, ParkLogic, Rook Media, Voodoo, and recognition for all types of parked domains.
  • Telecom Abuse: Screen text messages, SMS, and user messages in real time to detect phishing, malicious links, affiliate spam, and other abuse.
  • Filter Email Spammer Domains: Sift through suspicious emails with detection for domains confirmed as sending email SPAM. Further validate SPAM with real-time email threat scoring.
  • Abusive Domains: Block emails from disposable email services and throwaway accounts. Pair with IP reputation checks for deeper insight.

Follow the instructions below to use the Malicious URL Scanner API.

Using the API

You can use the following URLs to submit URLs to the Malicious URL Scanner API using cURL or another utility in most languages. Replace URL_HERE with the URL to analyze.

JSON
https://www.ipqualityscore.com/api/json/url/YOUR_API_KEY_HERE/URL_HERE

XML
https://www.ipqualityscore.com/api/xml/url/YOUR_API_KEY_HERE/URL_HERE

Example Request

API Lookup with URL Encoded Link
The API can accept a domain or a full URL. To submit a full URL, you must first URL encode it:

https://www.ipqualityscore.com/api/json/url/YOUR_API_KEY_HERE/https%3A%2F%2Fexample.com

Example Responses

Success Responses

This is an example success response in JSON format. Details about each of these variables can be found in Response Parameters.

{
	"message": "Success.",
	"success": true,
	"unsafe": false,
	"domain": "google.com",
	"root_domain": "google.com",
	"ip_address": "172.217.7.206",
	"country_code": "US",
	"language_code": "EN",
	"server": "nginx",
	"content_type": "text/html; charset=UTF-8",
	"status_code": 200,
	"page_size": 68553,
	"domain_rank": 1,
	"dns_valid": true,
	"parking": false,
	"spamming": false,
	"malware": false,
	"phishing": false,
	"suspicious": false,
	"domain_trust":"trusted",
	"short_link_redirect":false,
	"hosted_content":false,
	"page_title":"Google",
	"risky_tld":false,
	"spf_record":true,
	"dmarc_record":true,
	"technologies":["Google Tag Manager","Google Ads","WordPress","Shopify","Cloudflare"],
	"a_records":["172.67.151.40","104.21.72.140"],
	"mx_records":["us-smtp-inbound-1.mimecast.com", "aspmx.l.google.com"],
	"ns_records":["finley.ns.cloudflare.com","melinda.ns.cloudflare.com"],
	"adult": false,
	"risk_score": 0,
	"domain_age": {
		"human":"26 years ago",
		"timestamp":874296000,
		"iso":"1997-09-15T00:00:00-04:00"
	},
	"category": "Search Engine",
	"redirected": false,
	"scanned_url": "http://google.com",
	"final_url": "http://google.com",
	"request_id": "4ZGSfWu9RDf3oH"
}

This is an example success response in XML format. Details about each of these variables can be found in Response Parameters.

<result>
	<message>Success.</message>
	<success>true</success>
	<unsafe>false</unsafe>
	<domain>google.com</domain>
	<ip_address>172.217.7.206</ip_address>
	<server>nginx</server>
	<country_code>US</country_code>
	<language_code>EN</language_code>
	<content_type>text/html; charset=UTF-8</content_type>
	<status_code>200</status_code>
	<page_size>68553</page_size>
	<domain_rank>1</domain_rank>
	<dns_valid>true</dns_valid>
	<parking>false</parking>
	<spamming>false</spamming>
	<malware>false</malware>
	<phishing>false</phishing>
	<suspicious>false</suspicious>
	<domain_trust>trusted</domain_trust>
	<short_link_redirect>false</short_link_redirect>
	<hosted_content>false</hosted_content>
	<short_link_redirect>false</short_link_redirect>
	<page_title>Google</page_title>
	<risky_tld>false</risky_tld>
	<spf_record>false</spf_record>
	<dmarc_record>false</dmarc_record>
	<adult>false</adult>
	<risk_score>0</risk_score>
	<technologies>["Google Tag Manager","Google Ads","WordPress","Shopify","Cloudflare"]</technologies>
	<domain_age>
		<human>3 months ago</human>
		<timestamp>1568061634</timestamp>
		<iso>2019-09-09T16:40:34-04:00</iso>
	</domain_age>
	<category>Search Engine</category>
	<redirected>false</redirected>
	<request_id>0tt6tE</request_id>
</result>

Error Responses

Example errors that you may encounter when accessing our API due to an exhausted credit balance or an invalid request.

{
	"success":false,
	"message":"You have insufficient credits to make this query. Please contact IPQualityScore support if this error persists.",
	"request_id":"4OTORR352FU0p"
}

Next Steps

Tailor your API requests to match your specific needs with additional request parameters and other advanced options. Or learn more about each of the variables included in the responses you receive.

<textarea class="code">
// Your API Key.
$key = 'YOUR_API_KEY_HERE';

/*
* URL to scan - URL Encoded in cURL function below.
*/
$URL = 'https://www.google.com';

// Adjustable strictness level from 0 to 2. 0 is the least strict and recommended for most use cases. Higher strictness levels can increase false-positives.
$strictness = 0;

// Create parameters array.
$parameters = array(
	'strictness' => $strictness
);

// Format Parameters
$formatted_parameters = http_build_query($parameters);

// Create API URL
$url = sprintf(
	'https://www.ipqualityscore.com/api/json/url/%s/%s?%s',
	$key,
	urlencode($URL),
	$formatted_parameters
);

// Fetch The Result
$timeout = 5;

$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $url);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, $timeout);

$json = curl_exec($curl);
curl_close($curl);

// Decode the result into an array.
$result = json_decode($json, true);

// Check to see if our query was successful.
if(isset($result['success']) && $result['success'] === true){
	// NOTICE: If you want to use one of the examples below, remove
	// any lines containing /*, */ and *-, then remove * from any of the
	// the remaining lines.

	/*
	*- Example 1: Identify suspicious URLs regardless of Risk Score
	* 
	* if($result['suspicious'] === true){
	*	// flag suspicious URL
	* }
	*/
	
	/*
	*- Example 2: We'd like to block all malicious URLs suspected of being used for phishing or malware
	*
	* if($result['phishing'] === true || $result['malware'] === true || $result['risk_score'] > 85){
	*	// flag high risk URLs likely to be malicious
	* }
	*/
	
	/*
	*- Example 3: We'd like to block all links on parked domains
	*
	* if($result['parking'] === true){
	*	// flag parked domains
	* }
	*/
	
	/*
	* If you are confused with these examples or simply have a use case
	* not covered here, please feel free to contact IPQualityScore's support
	* team. We'll craft a custom piece of code to meet your requirements.
	*/
}

import json
import requests
import urllib

# You may need to install Requests pip
# python -m pip install requests

class IPQS:
    key = 'YOUR_API_KEY_HERE'
    def malicious_url_scanner_api(self, url: str, vars: dict = {}) -> dict:
        url = 'https://www.ipqualityscore.com/api/json/url/%s/%s' % (self.key, urllib.parse.quote_plus(url))
        x = requests.get(url, params = vars)
        print(x.text)
        return (json.loads(x.text))

if __name__ == "__main__":        
    """
    URL to scan - URL Encoded in cURL function below.
    """
    URL = 'https://www.google.com'

    #Adjustable strictness level from 0 to 2. 0 is the least strict and recommended for most use cases. Higher strictness levels can increase false-positives.
    strictness = 0

    #custom feilds
    additional_params = {
        'strictness' : strictness
    }

    ipqs = IPQS()
    result = ipqs.malicious_url_scanner_api(URL, additional_params)

    if 'success' in result and result['success'] == True:
        print(result)
        """
        NOTICE: If you want to use one of the examples below, remove
        any lines containing /*, */ and *-, then remove * from any of the
        the remaining lines.
        """
        
        """
        - Example 1: Identify suspicious URLs regardless of Risk Score
        
        if result['suspicious'] == True:
        # flag suspicious URL
        }
        """
        
        """
        - Example 2: We'd like to block all malicious URLs suspected of being used for phishing or malware
        
        if result['phishing'] == True or result['malware'] === True or result['risk_score'] > 85):
            # flag high risk URLs likely to be malicious
        }
        """
        
        """
        - Example 3: We'd like to block all links on parked domains
        
        if result['parking'] == True:
        	# flag parked domains
        }
        """
        
        """
        If you are confused with these examples or simply have a use case
        not covered here, please feel free to contact IPQualityScore's support
        team. We'll craft a custom piece of code to meet your requirements.
        """

Ready to eliminate fraud?

Start fighting fraud now with 1,000 Free Lookups!

We're happy to answer any questions or concerns.

Chat with our fraud detection experts any day of the week.

Call us at: (800) 713-2618

Schedule a Demo Sign Up