Skip to main content

​
Overview


Every ScanURL request returns a structured JSON response containing core decision fields and multiple layers of analysis. The response is designed to be both:
  • machine-readable (for integration)
  • human-interpretable (for debugging and review)
FieldTypeDescription
statusstringIndicates if scan was successful
final_verdictstringFinal classification of the URL
confidencestringCertainty level of the verdict
risk_scorenumberOverall risk score (0 to 1)
redirect_infoobjectRedirect tracking details
quick_scanobjectURL-level analysis
deep_scanobjectPage-level analysis
reputationobjectInfrastructure and domain checks

​
redirect_info

This section provides information about how the URL behaves during navigation.

​
Includes:

  • initial_url
  • final_url
  • http_chain
  • js_navigations
  • redirect_count

​
quick_scan

Represents fast URL-level analysis.

​
Key fields:

  • phishing_probability
  • risk_level
  • domain_age
  • reachable
New Domain Signal

If the domain is recently registered (for example, less than 30 days old), it will be flagged as a new domain.

​
deep_scan

This section represents the detailed analysis of the webpage after it is loaded in a browser environment. It captures page behavior, interaction patterns, and dynamic signals that are not visible from the URL alone.

​
Includes:

  • page_risk
  • ml_score
  • behavioral signals
  • form and interaction analysis

​
vision

This section contains visual and layout-based signals extracted from the rendered page. It helps identify login interfaces, credential collection patterns, and other visual indicators of risk.

​
Includes:

  • login_page_detected
  • credential_layout_detected
  • OCR-based signals

​
Reputation

This section provides domain-level trust information based on infrastructure and configuration checks. It includes signals such as SSL validity, DNS setup, and hosting characteristics.

​
Includes:

  • SSL certificate details
  • DNS configuration (SPF, DMARC)
  • ASN and hosting information
  • reputation_score

​
Example Response

Response -
{
    "success": true,
    "data": {
        "status": "success",
        "final_verdict": "Trusted",
        "confidence": "high",
        "risk_score": 0,
        "redirect_info": {
            "initial_url": "https://www.facebook.com/",
            "final_url": "https://www.facebook.com/",
            "http_chain": [
                "https://www.facebook.com/"
            ],
            "js_navigations": [
                "https://www.facebook.com/"
            ],
            "redirect_count": 0,
            "redirect_limit_exceeded": false
        },
        "quick_scan": {
            "domain_age": 10618,
            "reachable": true,
            "risk_level": "SAFE",
            "stage": "ml",
            "phishing_probability": 0.00016953381224745623
        },
        "deep_scan": {
            "verdict": "Trusted",
            "confidence": "high",
            "url_risk": 0,
            "page_risk": 0,
            "final_score": 0,
            "ml_score": 0,
            "vision": {
                "login_page_detected": false,
                "credential_layout_detected": false,
                "vision_score": 0,
                "ocr_text_detected": true,
                "ocr_browser_warning": false,
                "ocr_access_block": false,
                "ocr_page_error": false,
                "ocr_under_construction": false,
                "ocr_adult_keywords_detected": false,
                "vision_available": true
            },
            "reputation": {
                "reputation_score": 0,
                "infrastructure_risk_level": "low",
                "reasons": [
                    "Hosted on trusted enterprise infrastructure",
                    "Domain older than 5 years (stability signal)"
                ],
                "ssl": {
                    "cert_present": true,
                    "cert_age_days": 82,
                    "cert_valid_days_remaining": 8,
                    "cert_issuer": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US",
                    "self_signed": false,
                    "cert_valid": true,
                    "cert_expired": false
                },
                "dns": {
                    "mx_present": true,
                    "spf_present": true,
                    "dmarc_present": true,
                    "dmarc_policy": "reject",
                    "dmarc_strict": true
                },
                "asn": {
                    "ip": "57.144.42.1",
                    "asn": "32934",
                    "asn_org": "FACEBOOK - Facebook, Inc., US",
                    "hosting_provider": "FACEBOOK - Facebook, Inc., US",
                    "is_cloud_hosting": false,
                    "is_suspicious_hosting": false,
                    "is_cdn": false,
                    "is_enterprise_infra": true,
                    "is_cloud_vps": false
                }
            }
        }
    }
}

​
Analysis Layers Summary

SectionWhat It Represents
quick_scanFast URL-level risk analysis
deep_scanPage behavior and interaction analysis
visionVisual and UI-based signals
reputationDomain and infrastructure trust signals