<< Back to Categories

Getting Started

About the Malicious URL Scanner API

The IPQS Malicious URL Scanner API scans links in real time to detect suspicious URLs. Accurately identify phishing links, malware URLs and viruses, parked domains, and suspicious URLs with real-time risk scores. Industry-leading phishing detection and domain reputation provide better signals for more accurate decision-making.

Scan URLs for malware to detect poor reputation domains, suspicious links, and phishing URLs with a real-time API that you can integrate directly into your site, SOAR, or other third-party software. Accurately check URLs for malware without false positives or missed hit rates. Take URL intelligence a step further with parking domain detection and support to identify domains used for email spam. Quickly enhance your SIEM/SOAR platform intelligence with our URL Threat Scanning API. Classify websites with over 70 website categories for easier analysis of unknown sites.

You can test out the IPQS malicious URL scanner using our free tool.

API Request URLs

You can use the following URLs to submit URLs to the Malicious URL Scanner API using cURL or another utility in most languages. Replace URL_HERE with the URL to analyze.

JSON

XML

Example Request

API Lookup with URL Encoded Link
The API can accept a domain or a full URL. To submit a full URL, you must first URL encode it:

Example Responses

Success Responses

This is an example success response in JSON format. Details about each of these variables can be found in Response Parameters.

{
	"message": "Success.",
	"success": true,
	"unsafe": false,
	"domain": "google.com",
	"root_domain": "google.com",
	"ip_address": "172.217.7.206",
	"country_code": "US",
	"language_code": "EN",
	"server": "nginx",
	"content_type": "text\/html; charset=UTF-8",
	"status_code": 200,
	"page_size": 68553,
	"domain_rank": 1,
	"dns_valid": true,
	"parking": false,
	"spamming": false,
	"malware": false,
	"phishing": false,
	"suspicious": false,
	"domain_trust":"trusted",
	"short_link_redirect":false,
	"hosted_content":false,
	"page_title":"Google",
	"risky_tld":false,
	"spf_record":true,
	"dmarc_record":true,
	"technologies":["Google Tag Manager","Google Ads","WordPress","Shopify","Cloudflare"],
	"a_records":["172.67.151.40","104.21.72.140"],
	"mx_records":["us-smtp-inbound-1.mimecast.com", "aspmx.l.google.com"],
	"ns_records":["finley.ns.cloudflare.com","melinda.ns.cloudflare.com"],
	"adult": false,
	"risk_score": 0,
	"domain_age": {
		"human":"26 years ago",
		"timestamp":874296000,
		"iso":"1997-09-15T00:00:00-04:00"
	},
	"category": "Search Engine",
	"redirected": false,
	"scanned_url": "http:\/\/google.com",
	"final_url": "http:\/\/google.com",
	"request_id": "4ZGSfWu9RDf3oH"
}

This is an example success response in XML format. Details about each of these variables can be found in Response Parameters.

<result>
	<message>Success.</message>
	<success>true</success>
	<unsafe>false</unsafe>
	<domain>google.com</domain>
	<ip_address>172.217.7.206</ip_address>
	<server>nginx</server>
	<country_code>US</country_code>
	<language_code>EN</language_code>
	<content_type>text/html; charset=UTF-8</content_type>
	<status_code>200</status_code>
	<page_size>68553</page_size>
	<domain_rank>1</domain_rank>
	<dns_valid>true</dns_valid>
	<parking>false</parking>
	<spamming>false</spamming>
	<malware>false</malware>
	<phishing>false</phishing>
	<suspicious>false</suspicious>
	<domain_trust>trusted</domain_trust>
	<short_link_redirect>false</short_link_redirect>
	<hosted_content>false</hosted_content>
	<short_link_redirect>false</short_link_redirect>
	<page_title>Google</page_title>
	<risky_tld>false</risky_tld>
	<spf_record>false</spf_record>
	<dmarc_record>false</dmarc_record>
	<adult>false</adult>
	<risk_score>0</risk_score>
	<technologies>["Google Tag Manager","Google Ads","WordPress","Shopify","Cloudflare"]</technologies>
	<domain_age>
		<human>3 months ago</human>
		<timestamp>1568061634</timestamp>
		<iso>2019-09-09T16:40:34-04:00</iso>
	</domain_age>
	<category>Search Engine</category>
	<redirected>false</redirected>
	<request_id>0tt6tE</request_id>
</result>

Error Responses

Example errors that you may encounter when accessing our API due to an exhausted credit balance or an invalid request.

{
	"success":false,
	"message":"You have insufficient credits to make this query. Please contact IPQualityScore support if this error persists.",
	"request_id":"4OTORR352FU0p"
}

Next Steps

Tailor your API requests to match your specific needs with additional request parameters and other advanced options. Or learn more about each of the variables included in the responses you receive.

EXAMPLE CODE

PHP
PYTHON

<textarea class="code">
// Your API Key.
$key = 'YOUR_API_KEY_HERE';

/*
* URL to scan - URL Encoded in cURL function below.
*/
$URL = 'https://www.google.com';

// Adjustable strictness level from 0 to 2. 0 is the least strict and recommended for most use cases. Higher strictness levels can increase false-positives.
$strictness = 0;

// Create parameters array.
$parameters = array(
	'strictness' => $strictness
);

// Format Parameters
$formatted_parameters = http_build_query($parameters);

// Create API URL
$url = sprintf(
	'https://www.ipqualityscore.com/api/json/url/%s/%s?%s',
	$key,
	urlencode($URL),
	$formatted_parameters
);

// Fetch The Result
$timeout = 5;

$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $url);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, $timeout);

$json = curl_exec($curl);
curl_close($curl);

// Decode the result into an array.
$result = json_decode($json, true);

// Check to see if our query was successful.
if(isset($result['success']) && $result['success'] === true){
	// NOTICE: If you want to use one of the examples below, remove
	// any lines containing /*, */ and *-, then remove * from any of the
	// the remaining lines.

	/*
	*- Example 1: Identify suspicious URLs regardless of Risk Score
	* 
	* if($result['suspicious'] === true){
	*	// flag suspicious URL
	* }
	*/
	
	/*
	*- Example 2: We'd like to block all malicious URLs suspected of being used for phishing or malware
	*
	* if($result['phishing'] === true || $result['malware'] === true || $result['risk_score'] > 85){
	*	// flag high risk URLs likely to be malicious
	* }
	*/
	
	/*
	*- Example 3: We'd like to block all links on parked domains
	*
	* if($result['parking'] === true){
	*	// flag parked domains
	* }
	*/
	
	/*
	* If you are confused with these examples or simply have a use case
	* not covered here, please feel free to contact IPQualityScore's support
	* team. We'll craft a custom piece of code to meet your requirements.
	*/
}

import json
import requests
import urllib

# You may need to install Requests pip
# python -m pip install requests

class IPQS:
    key = 'YOUR_API_KEY_HERE'
    def malicious_url_scanner_api(self, url: str, vars: dict = {}) -> dict:
        url = 'https://www.ipqualityscore.com/api/json/url/%s/%s' % (self.key, urllib.parse.quote_plus(url))
        x = requests.get(url, params = vars)
        print(x.text)
        return (json.loads(x.text))

if __name__ == "__main__":        
    """
    URL to scan - URL Encoded in cURL function below.
    """
    URL = 'https://www.google.com'

    #Adjustable strictness level from 0 to 2. 0 is the least strict and recommended for most use cases. Higher strictness levels can increase false-positives.
    strictness = 0

    #custom feilds
    additional_params = {
        'strictness' : strictness
    }

    ipqs = IPQS()
    result = ipqs.malicious_url_scanner_api(URL, additional_params)

    if 'success' in result and result['success'] == True:
        print(result)
        """
        NOTICE: If you want to use one of the examples below, remove
        any lines containing /*, */ and *-, then remove * from any of the
        the remaining lines.
        """
        
        """
        - Example 1: Identify suspicious URLs regardless of Risk Score
        
        if result['suspicious'] == True:
        # flag suspicious URL
        }
        """
        
        """
        - Example 2: We'd like to block all malicious URLs suspected of being used for phishing or malware
        
        if result['phishing'] == True or result['malware'] === True or result['risk_score'] > 85):
            # flag high risk URLs likely to be malicious
        }
        """
        
        """
        - Example 3: We'd like to block all links on parked domains
        
        if result['parking'] == True:
        	# flag parked domains
        }
        """
        
        """
        If you are confused with these examples or simply have a use case
        not covered here, please feel free to contact IPQualityScore's support
        team. We'll craft a custom piece of code to meet your requirements.
        """

Ready to eliminate fraud?

Start fighting fraud now with 5,000 Free Lookups!

We're happy to answer any questions or concerns.

Chat with our fraud detection experts any day of the week.

Call us at: (800) 713-2618

Schedule a Demo Sign Up