ScanMalware
ScanMalware renders URLs in a sandboxed headless browser and keeps every scan in a searchable archive. This connector lets Claude ask what the archive already knows about a domain, URL or IP address, and pivot from one suspicious page to related infrastructure. What it can do: - Read a scan's verdict and risk factors, network requests, IOCs, TLS and JARM details, detected technologies, YARA matches, OCR text and RDAP data. - Find related scans by domain, IP, ASN, JARM signature, favicon hash, screenshot hash, TLSH/ssdeep/sdhash fuzzy hash, OCR text, tracking keys or JavaScript fingerprint. - Look up Certificate Transparency records for a domain or IP. - Submit a new URL for scanning and wait for the result. 126 of the 128 tools are read-only. The two write tools submit a URL for scanning and vote on a scan as safe or malicious. Every new scan must declare its visibility: "public" publishes the URL and its results in the public feed, while "unlisted" keeps them out of public listings. No account or API key is needed. ScanMalware is operated by Triop AB in Sweden.
Where it stands
Tools
find_js_ fingerprint_ similar_ by_ hash get_ai_ analysis get_analyzer_ results get_analyzer_ stats get_api_ root get_bot_ protection get_capabilities_ by_ date get_clipboard_ events get_clipboard_ stats get_cpe_ by_ scan get_cpe_ stats get_ct_ certificates get_ct_ dns_ records get_ct_ domains_ by_ ip get_ct_ similar_ domains get_ct_ timeline get_domain_ history get_domain_ scans get_domain_ stats get_favicon get_favicon_ stats get_health get_ids_ alerts get_ip_ stats get_jarm_ signatures get_jarm_ stats get_js_ fingerprints get_js_ library_ inventory get_js_ runtime_ behaviour get_js_ runtime_ coverage get_js_ runtime_ health get_js_ runtime_ stats get_js_ segments_ by_ scan get_js_ segments_ suspicious get_js_ segments_ unknown get_jsfingerprint get_jsfingerprint_ bundle_ stats get_jsfingerprint_ hash_ prevalence get_jsfingerprint_ library_ stats get_jsfingerprint_ similar get_jsfingerprint_ similarity_ counts get_jsfingerprint_ source get_latest_ capabilities get_malware_ by_ scan get_malware_ stats get_netlog get_ocr_ by_ scan get_ocr_ stats get_open_ graph get_pastejacking get_pcap_ metadata get_platform_ stats get_popular_ technologies get_rdap get_recent_ scans get_recent_ threats get_recent_ yara_ threats get_safe_ browsing get_safe_ browsing_ stats get_scan_ ioc get_scan_ progress get_scan_ reports get_scan_ result get_scan_ summary get_screenshot_ stats get_technologies_ by_ scan get_technology_ combinations get_technology_ stats get_tls_ asn1 get_tls_ details get_top_ tracking_ keys get_yara_ by_ scan get_yara_ matches get_yara_ stats run_js_ differential_ analysis search_ai_ classification search_ai_ high_ risk search_ai_ scam_ type search_analyzer_ high_ risk search_by_ asn search_by_ favicon search_by_ fuzzy_ hash search_by_ ip search_by_ jarm search_by_ nameserver search_by_ registrar search_by_ screenshot_ hash search_cpe search_favicon_ mmh3 search_js_ fingerprint_ by_ bundler search_js_ fingerprint_ by_ cdn search_js_ fingerprint_ by_ fuzzy_ hash search_js_ fingerprint_ by_ library search_js_ fingerprint_ by_ library_ version search_js_ fingerprint_ by_ md5 search_js_ fingerprint_ by_ normalized_ hash search_js_ fingerprint_ by_ server search_js_ fingerprint_ by_ sha1 search_js_ fingerprint_ by_ sha256 search_js_ fingerprint_ obfuscated search_js_ fingerprint_ patterns search_js_ malware_ families search_js_ obfuscation search_js_ runtime_ by_ composite_ hash search_js_ runtime_ by_ signature search_js_ runtime_ similar search_js_ segments_ by_ hash search_js_ segments_ by_ normalized_ hash search_jsfingerprints_ by_ bundler search_jsfingerprints_ by_ fuzzy_ hash search_jsfingerprints_ by_ library search_jsfingerprints_ by_ library_ version search_jsfingerprints_ by_ md5 search_jsfingerprints_ by_ normalized_ hash search_jsfingerprints_ by_ sha1 search_jsfingerprints_ by_ sha256 search_ocr search_ocr_ pattern search_scans search_semantic search_similar_ scans search_similar_ screenshots search_suspicious_ clipboard search_technologies search_tracking_ key submit_scan submit_scan_ report wait_for_ scan