Response Structure - Scanurl.ai

Overview

Every Scanurl.ai request returns a structured JSON response containing core decision fields and multiple layers of analysis. The response is designed to be both:

Machine-Readable (For integration)
Human-Interpretable (For debugging and review)

Field	Type	Description
Status	String	Indicates if scan was successful
final_verdict	String	Final classification of the URL
confidence	String	Certainty level of the verdict
risk_score	Number	Overall risk score (0 to 1)
redirect_info	Object	Redirect tracking details
quick_scan	Object	URL-level analysis
deep_scan	Object	Page-level analysis
reputation	Object	Infrastructure and domain checks

redirect_info

This section provides information about how the URL behaves during navigation.

Includes:

initial_url
final_url
http_chain
js_navigations
redirect_count

quick_scan

Represents fast URL-level analysis.

Key fields:

phishing_probability
risk_level
domain_age
reachable

New Domain Signal

If the domain is recently registered (for example, less than 30 days old), it will be flagged as a new domain.

deep_scan

This section represents the detailed analysis of the webpage after it is loaded in a browser environment. It captures page behavior, interaction patterns, and dynamic signals that are not visible from the URL alone.

Includes:

page_risk
ml_score
behavioral signals
form and interaction analysis

vision

This section contains visual and layout-based signals extracted from the rendered page. It helps identify login interfaces, credential collection patterns, and other visual indicators of risk.

Includes:

login_page_detected
credential_layout_detected
OCR-based signals

Reputation

This section provides domain-level trust information based on infrastructure and configuration checks. It includes signals such as SSL validity, DNS setup, and hosting characteristics.

Includes:

SSL certificate details
DNS configuration (SPF, DMARC)
ASN and hosting information
reputation_score

Example Response

Response -
{
    "success": true,
    "data": {
        "status": "success",
        "final_verdict": "Trusted",
        "confidence": "high",
        "risk_score": 0,
        "redirect_info": {
            "initial_url": "https://www.scanurl.ai/",
            "final_url": "https://www.scanurl.ai/",
            "http_chain": [
                "https://www.scanurl.ai/"
            ],
            "js_navigations": [
                "https://www.scanurl.ai/"
            ],
            "redirect_count": 0,
            "redirect_limit_exceeded": false
        },
        "quick_scan": {
            "domain_age": 10618,
            "reachable": true,
            "risk_level": "SAFE",
            "stage": "ml",
            "phishing_probability": 0.00016953381224745623
        },
        "deep_scan": {
            "verdict": "Trusted",
            "confidence": "high",
            "url_risk": 0,
            "page_risk": 0,
            "final_score": 0,
            "ml_score": 0,
            "vision": {
                "login_page_detected": false,
                "credential_layout_detected": false,
                "vision_score": 0,
                "ocr_text_detected": true,
                "ocr_browser_warning": false,
                "ocr_access_block": false,
                "ocr_page_error": false,
                "ocr_under_construction": false,
                "ocr_adult_keywords_detected": false,
                "vision_available": true
            },
            "reputation": {
                "reputation_score": 0,
                "infrastructure_risk_level": "low",
                "reasons": [
                    "Hosted on trusted enterprise infrastructure",
                    "Domain older than 5 years (stability signal)"
                ],
                "ssl": {
                    "cert_present": true,
                    "cert_age_days": 82,
                    "cert_valid_days_remaining": 8,
                    "cert_issuer": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US",
                    "self_signed": false,
                    "cert_valid": true,
                    "cert_expired": false
                },
                "dns": {
                    "mx_present": true,
                    "spf_present": true,
                    "dmarc_present": true,
                    "dmarc_policy": "reject",
                    "dmarc_strict": true
                },
                "asn": {
                    "ip": "57.144.42.1",
                    "asn": "32934",
                    "asn_org": "NSO INDIA",
                    "hosting_provider": "Amazon Web Services, Inc",
                    "is_cloud_hosting": false,
                    "is_suspicious_hosting": false,
                    "is_cdn": false,
                    "is_enterprise_infra": true,
                    "is_cloud_vps": false
                }
            }
        }
    }
}

Analysis Layers Summary

Section	What It Represents
Quick_Scan	Fast URL-level risk analysis
deep_scan	Page behavior and interaction analysis
vision	Visual and UI-based signals
reputation	Domain and infrastructure trust signals

​Overview

​redirect_info

​Includes:

​quick_scan

​Key fields:

​deep_scan

​Includes:

​vision

​Includes:

​Reputation

​Includes:

​Example Response

​Analysis Layers Summary

Overview

redirect_info

Includes:

quick_scan

Key fields:

deep_scan

Includes:

vision

Includes:

Reputation

Includes:

Example Response

Analysis Layers Summary