ScanMalware

ClaudeCommunityby Triop AB

ScanMalware renders URLs in a sandboxed headless browser and keeps every scan in a searchable archive. This connector lets Claude ask what the archive already knows about a domain, URL or IP address, and pivot from one suspicious page to related infrastructure. What it can do: - Read a scan's verdict and risk factors, network requests, IOCs, TLS and JARM details, detected technologies, YARA matches, OCR text and RDAP data. - Find related scans by domain, IP, ASN, JARM signature, favicon hash, screenshot hash, TLSH/ssdeep/sdhash fuzzy hash, OCR text, tracking keys or JavaScript fingerprint. - Look up Certificate Transparency records for a domain or IP. - Submit a new URL for scanning and wait for the result. 126 of the 128 tools are read-only. The two write tools submit a URL for scanning and vote on a scan as safe or malicious. Every new scan must declare its visibility: "public" publishes the URL and its results in the public feed, while "unlisted" keeps them out of public listings. No account or API key is needed. ScanMalware is operated by Triop AB in Sweden.

Details

Data AnalyticsDeveloper Tools

Listed Oct 8, 2026

by Triop AB

scanmalware.com/

MCP endpoint: https://mcp.scanmalware.com/mcp · streamable-http

Available tools (128)

find_js_fingerprint_similar_by_hashget_ai_analysisget_analyzer_resultsget_analyzer_statsget_api_rootget_bot_protectionget_capabilities_by_dateget_clipboard_eventsget_clipboard_statsget_cpe_by_scanget_cpe_statsget_ct_certificatesget_ct_dns_recordsget_ct_domains_by_ipget_ct_similar_domainsget_ct_timelineget_domain_historyget_domain_scansget_domain_statsget_faviconget_favicon_statsget_healthget_ids_alertsget_ip_statsget_jarm_signaturesget_jarm_statsget_js_fingerprinter2get_js_fingerprinter2_coverageget_js_fingerprinter2_healthget_js_fingerprinter2_statsget_js_fingerprintsget_js_library_inventoryget_js_segments_by_scanget_js_segments_suspiciousget_js_segments_unknownget_jsfingerprintget_jsfingerprint_bundle_statsget_jsfingerprint_hash_prevalenceget_jsfingerprint_library_statsget_jsfingerprint_similarget_jsfingerprint_similarity_countsget_jsfingerprint_sourceget_latest_capabilitiesget_malware_by_scanget_malware_statsget_netlogget_ocr_by_scanget_ocr_statsget_open_graphget_pastejackingget_pcap_metadataget_platform_statsget_popular_technologiesget_rdapget_recent_scansget_recent_threatsget_recent_yara_threatsget_safe_browsingget_safe_browsing_statsget_scan_iocget_scan_progressget_scan_reportsget_scan_resultget_scan_summaryget_screenshot_statsget_technologies_by_scanget_technology_combinationsget_technology_statsget_tls_asn1get_tls_detailsget_top_tracking_keysget_yara_by_scanget_yara_matchesget_yara_statsrun_js_differential_analysissearch_ai_classificationsearch_ai_high_risksearch_ai_scam_typesearch_analyzer_high_risksearch_by_asnsearch_by_faviconsearch_by_fuzzy_hashsearch_by_ipsearch_by_jarmsearch_by_nameserversearch_by_registrarsearch_by_screenshot_hashsearch_cpesearch_favicon_mmh3search_js_fingerprint_by_bundlersearch_js_fingerprint_by_cdnsearch_js_fingerprint_by_fuzzy_hashsearch_js_fingerprint_by_librarysearch_js_fingerprint_by_library_versionsearch_js_fingerprint_by_md5search_js_fingerprint_by_normalized_hashsearch_js_fingerprint_by_serversearch_js_fingerprint_by_sha1search_js_fingerprint_by_sha256search_js_fingerprint_obfuscatedsearch_js_fingerprint_patternssearch_js_fingerprinter2_composite_hashsearch_js_fingerprinter2_signaturesearch_js_fingerprinter2_similarsearch_js_malware_familiessearch_js_obfuscationsearch_js_segments_by_hashsearch_js_segments_by_normalized_hashsearch_jsfingerprints_by_bundlersearch_jsfingerprints_by_fuzzy_hashsearch_jsfingerprints_by_librarysearch_jsfingerprints_by_library_versionsearch_jsfingerprints_by_md5search_jsfingerprints_by_normalized_hashsearch_jsfingerprints_by_sha1search_jsfingerprints_by_sha256search_ocrsearch_ocr_patternsearch_scanssearch_semanticsearch_similar_scanssearch_similar_screenshotssearch_suspicious_clipboardsearch_technologiessearch_tracking_keysubmit_scansubmit_scan_reportwait_for_scan

Open in Claude