bots.st/scanmalware-com-url-scanner

ScanMalware.com URL Scanner

Scan URLs and report malware risk

1991 ms

answered our call 8 Nov, 02:29 UTC

State: Answered
Protocol: MCP 2025-06-18
Tools listed: 128
Answered: 4 of the last 4 calls

How to reach it

MCP, HTTPhttps://mcp.scanmalware.com/mcp

What it can do

Tool	What it says it does
`find_js_fingerprint_similar_by_hash`	Find JavaScript files similar to the file with this content SHA-256, above threshold (default 0.7), up to limit results; exclude_exact_matches drops identical copies. Useful for finding modified versions of a known script.
`get_ai_analysis`	Get the AI analysis of one scan: classification (LEGITIMATE to CONFIRMED_SCAM), scam type, risk score, confidence, impersonated brand and the key evidence behind it. The analysis is produced a few minutes after the scan completes and returns not found until then. It can disagree with the scanner's…
`get_analyzer_results`	List which analysis modules ran for one scan (for example JavaScript fingerprinting and AI analysis), with each module's status, success flag and timing. Useful for checking why a result is missing. scan_id is the UUID of a ScanMalware scan.
`get_analyzer_stats`	Get platform-wide statistics for the scan analysis modules: the modules and their run counts. Describes the service, not a particular scan.
`get_api_root`	Get the ScanMalware API's name, version, status, main endpoints and feature list.
`get_bot_protection`	Get the bot-protection and CAPTCHA services detected on a scanned page (for example Cloudflare Turnstile), with a detected flag. Phishing kits often use these to hide from scanners. scan_id is the UUID of a ScanMalware scan.
`get_capabilities_by_date`	Get the size of ScanMalware's detection content (indicators, detection rules, ClamAV signatures) on a given date (scan_date, YYYY-MM-DD).
`get_clipboard_events`	Get the clipboard writes the page attempted while it was scanned, with the event count and whether collection ran. Empty with an explanatory note when the page wrote nothing. scan_id is the UUID of a ScanMalware scan.
`get_clipboard_stats`	Get clipboard and pastejacking statistics across the archive: event totals, detections and daily activity.
`get_cpe_by_scan`	List the CPE identifiers (product and version names in the NVD format) derived from the technologies detected on a scanned page, with their source. Useful for matching against vulnerability data. scan_id is the UUID of a ScanMalware scan.
`get_cpe_stats`	Get CPE statistics across the archive: scans with CPEs, unique CPEs, total detections, top vendors and products.
`get_ct_certificates`	Get the certificates issued for a domain according to Certificate Transparency logs, with a found flag.
`get_ct_dns_records`	List subdomains of a domain found through Certificate Transparency, with their DNS records (type, IP addresses, TTL) and when they were seen. Useful for finding the other hosts of a domain.
`get_ct_domains_by_ip`	List domains that Certificate Transparency and DNS data associate with an IP address, with record counts and the total.
`get_ct_similar_domains`	Find domains with names similar to a domain in Certificate Transparency data (for example lookalikes and typosquats), each with a certificate count and the kind of similarity.
`get_ct_timeline`	Get the certificate history of a domain from Certificate Transparency: when certificates were issued and when the certificate changed.
`get_domain_history`	Get the scan history of a domain with the total count and the scans, paginated with page and limit.
`get_domain_scans`	List the recent scans of a domain and its subdomains, newest first, up to limit; status filters by scan status. Each row has matched_on: 'url' when the scan was submitted for a host under this domain, and only 'final_url' when another site redirected there. A verdict on a final_url-only row…
`get_domain_stats`	Get scan counts for a domain: total, unique, completed and failed scans, first and latest scan, and scans in the last 24 hours, 7 days and 30 days.
`get_favicon`	Get the favicon recorded for a scan_id: its size, MD5 and SHA-256 hashes, and the image base64-encoded. found is false when no favicon is stored for the scan.
`get_favicon_stats`	Get favicon statistics across the archive: total favicons, those seen in the last 24 hours and the most common hashes with sample URLs. This aggregate query can take up to 90 seconds by default.
`get_health`	Check whether the ScanMalware API is up. Returns the service status.
`get_ids_alerts`	Get intrusion detection (IDS) alerts raised on the network traffic recorded during one scan, with a severity breakdown and total count. Empty when no rule fired. scan_id is the UUID of a ScanMalware scan.
`get_ip_stats`	Get statistics for an IP address across the archive: total scans, unique URLs, first and last seen, geolocation, ASN and organisation, BGP and DNS data; paginated.
`get_jarm_signatures`	Get the JARM TLS server fingerprints measured for the hosts in one scan, with whether each matches a known signature. A shared JARM often points to the same server software or hosting platform, so it is a weak pivot on its own. scan_id is the UUID of a ScanMalware scan.
`get_jarm_stats`	Get JARM statistics across the archive, including the most common signatures. Common signatures usually belong to large hosting platforms.
`get_js_fingerprints`	List the JavaScript files a scanned page loaded, each with its fingerprint: hashes (SHA-256, SHA-1, MD5, normalized and fuzzy), size metrics, detected library and bundler. The include_* options add function lists, HTTP headers or ML vector details. Useful for collecting script hashes to search for…
`get_js_library_inventory`	List the JavaScript libraries and versions detected across the archive, with how many scans used each; library filters to one library and min_count drops rare versions. Identifiers are lowercase names such as 'react', 'jquery' or 'nextjs'.
`get_js_runtime_behaviour`	Get the runtime JavaScript behaviour recorded for one scan: overall risk, risk scores, number of scripts, eval and Function-constructor calls and high-risk events, with a behavioural signature and composite hash. include_detailed_events adds the individual events. scan_id is the UUID of a…
`get_js_runtime_coverage`	Get how many scans have runtime JavaScript fingerprints: coverage percentage and the number of unique composite hashes and signatures. Describes the service, not a scan.
`get_js_runtime_health`	Check whether the runtime JavaScript analysis service is up, with its version.
`get_js_runtime_stats`	Get platform-wide statistics for runtime JavaScript analysis: risk distribution, averages and totals of eval calls and high-risk events. Describes the service, not a scan.
`get_js_segments_by_scan`	List the code segments (functions and blocks) extracted from one scan's JavaScript, each with location, length, snippet and hashes; script_url narrows to one file, paginated with limit and offset. scan_id is the UUID of a ScanMalware scan.
`get_js_segments_suspicious`	List the JavaScript code segments from one scan scored as suspicious, above min_risk_score, with location, snippet and risk details; paginated with limit and offset. scan_id is the UUID of a ScanMalware scan.
`get_js_segments_unknown`	List the JavaScript code segments from one scan that match no known library, at least min_code_length long; these are usually the page's own or a kit's code. Paginated with limit and offset. scan_id is the UUID of a ScanMalware scan.
`get_jsfingerprint`	Get one JavaScript fingerprint record by its numeric fingerprint_id: the script URL, scan, hashes, metrics and ML vector information; include_functions and include_http_headers add more detail.
`get_jsfingerprint_bundle_stats`	Get statistics on bundled JavaScript across the archive for a date range: share of bundled files and the breakdown by bundler (webpack, vite, rollup and so on) and module format.
`get_jsfingerprint_hash_prevalence`	For each script in one scan, report how common its hash is across the archive, which separates widely used library files from rare, page-specific code. scan_id is the UUID of a ScanMalware scan.
`get_jsfingerprint_library_stats`	Get statistics on JavaScript library detection across the archive for a date range: total fingerprints, detection rate and the most common libraries.
`get_jsfingerprint_similar`	Find JavaScript files whose fingerprint is similar to the one with this fingerprint_id, above threshold (0 to 1), paginated with limit and offset. exclude_same_scan drops matches from the same scan. Useful for finding variants of one script.
`get_jsfingerprint_similarity_counts`	Count how many archived JavaScript files are similar to the one with this fingerprint_id, per similarity model (composite, CodeBERT, GraphCodeBERT, AST and handcrafted features), capped at max_count. This query can take up to 90 seconds by default.
`get_jsfingerprint_source`	Get the stored source code of one JavaScript file by its numeric fingerprint_id, with its SHA-256, URL and length. Source can be long.
`get_latest_capabilities`	Get the current size of ScanMalware's detection content: indicator count, malware detection rules and ClamAV signatures.
`get_malware_by_scan`	Get the malware detections for files the scanned page delivered, with threat names, detection counts and the detection source. Empty when nothing was detected. scan_id is the UUID of a ScanMalware scan.
`get_malware_stats`	Get malware detection statistics across the archive: overall and last-24-hour counts, top threats and hourly trend.
`get_netlog`	Describe the network log (Chrome NetLog) for a scan_id: whether one exists, its size, and its encoding. The log itself is not returned - these are routinely tens of megabytes gzipped.
`get_ocr_by_scan`	Get the text read by OCR from the scan's screenshot, with language, confidence, word and character counts and any regions flagged as suspicious. Useful when page text is drawn as images. scan_id is the UUID of a ScanMalware scan.
`get_ocr_stats`	Get OCR statistics across the archive: scans with OCR text, average confidence and length, language distribution and daily counts.
`get_open_graph`	Get the Open Graph and Twitter card metadata the scanned page declared (title, description, image, site name). Phishing pages often copy a brand's metadata. scan_id is the UUID of a ScanMalware scan.
`get_pastejacking`	Get pastejacking findings for one scan: attempts by the page to replace what a visitor copies, a common trick for making victims paste malicious commands. Includes a detected flag and a note. scan_id is the UUID of a ScanMalware scan.
`get_pcap_metadata`	Describe the packet capture (PCAP) recorded during one scan: whether it exists, its size, compression and content type. The capture itself is not returned. scan_id is the UUID of a ScanMalware scan.
`get_platform_stats`	Get the current scan queue length, running scans and scans completed in the last 24 hours by visibility.
`get_popular_technologies`	List the most frequently detected web technologies over the last days (paginated).
`get_rdap`	Get registration data (RDAP) for the scanned domain and its IP addresses: registrar, registration and expiry dates, domain age, nameservers and status. A very young domain is a common phishing signal. scan_id is the UUID of a ScanMalware scan.
`get_recent_scans`	List the most recent public scans, newest first (paginated with page and limit). Each row has the scan ID, URL, status, visibility and submission time. Unlisted and private scans are never included.
`get_recent_threats`	List malware threats detected in scans during the last hours (default window set by the API), with totals and grouping by threat.
`get_recent_yara_threats`	List YARA rule matches from scans in the last hours, each with the scan, URL, rule, category, severity and confidence.
`get_safe_browsing`	Get Google Safe Browsing threats found for the URLs in one scan, with a has_threats flag. scan_id is the UUID of a ScanMalware scan.
`get_safe_browsing_stats`	Get Google Safe Browsing statistics across the archive: total threats, threats in the last 7 days, scans with threats and threat types.
`get_scan_ioc`	Check one scan against threat-intelligence indicator feeds: matching IP addresses and domains the page contacted, the threat types, and a summary of total and unique matches. scan_id is the UUID of a ScanMalware scan.

And 68 more tools.

In its maker's words

MCP server for ScanMalware.com URL scanning, malware detection, and analysis.

Website: mcp.scanmalware.com
Source: github.com/scanmalware/mcp-server
Publisher: mcp.scanmalware.com
Listed from: the official MCP Registry as com.scanmalware.mcp/scanmalware-mcp
Version: 0.1.6, updated 7 Jan 2026
Kinds of work: Security and trust, Browser and automation

The domain it lives on

scanmalware.com: registered 6 Dec 2012 (13 years ago), at Name SRS AB, its home page is a working site

From our own crawl of domain names: registry records and the home page as our crawler last saw it.

Every call we made

When	What happened	Time
8 Nov, 02:29 UTC	Answered	1991 ms
7 Nov, 23:07 UTC	Answered	1824 ms
7 Nov, 21:24 UTC	Answered	730 ms
7 Nov, 21:24 UTC	Answered	730 ms

Next door

Is this your bot? Claim its address to add a verified badge and keep the listing current.