Skip to content
Powershell module for interacting with the API.
Branch: master
Clone or download
Latest commit 2f8a129 Sep 18, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
tools modifications Aug 27, 2019

Build Status Powershell Gallery

🔍 PSURLScanio

A Powershell module for using the API.

PSURLScanio/PSUrlScanio is a Powershell module/wrapper for the API. The module allows you to quickly query/submit data to the service and incorporate it in to your automated threat hunting/intel processes using PoSh.

For example, let's hunt for some potential HSBC phishing pages that have embedded the companies logo! 🕵️‍ demo1

📦 Install

Head over to and get yourself an API key (, install the module and then run Connect-UrlScanio to set your key.

Install-Module -Name PSUrlScanio -Repository PSGallery
Connect-UrlScanio -ApiKey "2126abb6-3686-47ef-bae5-9daf6c9e0888"

📜 Examples

Search for the last scan for the domain

Search-Urlscanio -Domain -Limit 1 -Specific

TaskDate   : 28/08/2019 19:01:45
Submission : api
id         : 3313e096-3f4a-496f-9e9c-b0924e4d6824
URL        :
ApiResult  :
ResultPage :

(Omitting -Specific will return any scans where is called in any http request while loading the page)

Do the same but return the entire response rather than basic details.

Search-Urlscanio -Domain -Limit 1 -Specific -Raw Object

task           : @{visibility=public; method=api; ...}
stats          : @{uniqIPs=3; consoleMsgs=0; dataLength=746649; ...}
page           : @{country=US;; city=; ...}
uniq_countries : 2
_id            : 3313e096-3f4a-496f-9e9c-b0924e4d6824
result         :

Get results from a specific scan id.

Get-UrlScanioScan -uuid 03ba7a78-e779-4743-ae37-2b683ee9ec74

data     : @{requests=System.Object[]; cookies=System.Object[]; ...}
stats    : @{resourceStats=System.Object[]; protocolStats=System.Object[]; ...}
meta     : @{processors=}
task     : @{uuid=03ba7a78-e779-4743-ae37-2b683ee9ec74; ...}
page     : @{url=;; ...}
lists    : @{ips=System.Object[]; countries=System.Object[]; ...}
verdicts : @{overall=; urlscan=; engines=; community=}

Kick off a scan on the chosen domain/URL and return the scan results.

Start-UrlScanioScan -Url -ShowResults

data     : @{requests=System.Object[]; cookies=System.Object[]; ...}
stats    : @{resourceStats=System.Object[]; protocolStats=System.Object[]; tlsStats=System.Object[]; ...}
meta     : @{processors=}
task     : @{uuid=781d9c96-7638-4393-b504-3cbc1ef5adfc; time=28/08/2019 19:58:22; ...}
page     : @{url=; ...}
lists    : @{ips=System.Object[]; countries=System.Object[]; asns=System.Object[]; domains=System.Object[]; servers=System.Object[]; urls=System.Object[]; linkDomains=System.Object[]; certificates=System.Object[]; hashes=System.Object[]}
verdicts : @{overall=; urlscan=; engines=; community=}

(Example results have been truncated)


  • Can I contribute?
    • Yes please! Feel free to clone/test/add features and submit a PR or enhancement suggestion. Help yourself to the project board if you feel like it!
  • Why can I only get 10000 results? There are way more for this domain!
    • 10k results is the max limit for the API, and I haven't figured out a magical way around it (yet...).
  • Something's broke.
    • Please submit an issue for it and I'll take a look!


Feel free to reach out to me via twitter @sysgoblin.

If you fancy supporting me and what I'm working on you can always buy me a sfw beer (aka coffee) by the sponsor button on this repo. ☕👌

You can’t perform that action at this time.