osintverse-community/safebrowsing
Checks a URL against Google Safe Browsing's lists of malware, phishing and unwanted software sites
Takes url → finds url
Key required · Docker
Key required · Docker
Verified publisher
Check whether a link is phishing or malware
7 tools. 7 run with ot in a sandbox on Windows, macOS and Linux. Compare them side by side ↓
The safest way to look at a suspicious link is through other people's records. Blocklists such as Google Safe Browsing and PhishTank say whether it is a known phishing or malware page, URLhaus whether it served malware, and VirusTotal and urlscan what dozens of engines and earlier scans made of it, all without your browser loading the page.
With ot, in a sandbox
All URL tools →Windows, macOS and Linux, with Docker or Podman. Each tool runs in a read-only container that can reach only the sites it declares, and every result comes back in the same JSON shape.
osintverse-community/phishtank-lookup
Checks a URL against CIRCL's copy of the PhishTank feed of verified phishing pages
Takes url → finds url
No key · Python wheel
No key · Python wheel
Verified publisher
osintverse-community/urlhaus
Looks up a URL, domain, IP address or file hash in abuse.ch URLhaus: malware URLs, their status, tags and payloads
Takes domain, hash, ip address, url → finds document, domain, ip, url
Key required · Docker
Key required · Docker
Verified publisher
osintverse-community/virustotal
Looks up an IP, domain, URL or file hash in VirusTotal: engine verdicts, reputation, tags, owner, DNS records
Takes domain, hash, ip address, url → finds dns record, document, domain, ip…
Key required · Docker
Key required · Docker
Verified publisher
osintverse-community/urlscan-search
Searches urlscan.io's existing scans of a domain, IP or URL: each page's title, server, IP, network and country
Takes domain, ip address, url → finds domain, ip, subdomain, url
No key · Docker
No key · Docker
Verified publisher
osintverse-community/pulsedive
Looks up an IP, domain or URL in Pulsedive: risk level and factors, linked threats and feeds, ports, technologies
Takes domain, ip address, url → finds domain, ip, location, organization…
No key · Docker
No key · Docker
Verified publisher
osintverse-community/otx-indicators
Looks up an IP, domain, URL or file hash in AlienVault OTX: the threat reports that mention it, malware, tags
Takes domain, hash, ip address, url → finds document, domain, ip, location…
No key · Docker
No key · Docker
Verified publisher
ot install osintverse-community/safebrowsing osintverse-community/phishtank-lookup osintverse-community/urlhaus osintverse-community/virustotal osintverse-community/urlscan-searchInstalls the first 5 in one go; ot auto url:… then runs every installed tool that takes an URL and saves the results. No ot yet? Install it in one line.
The 7 registry tools side by side
| osintverse-community/ | document, domain, ip, location… | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | url | None | Online, passive | No | Python | No reports yet | fewer than 10 |
| osintverse-community/ | domain, ip, location, organization… | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | url | Required | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | document, domain, ip, url | Required | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | domain, ip, subdomain, url | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | dns record, document, domain, ip… | Required | Online, passive | No | Docker | No reports yet | fewer than 10 |
Facts from each tool's manifest and what people report about whether it works. "Reaches" says whether a run stays offline, reads public sources, sends requests about the target, or may notify them.
How to check whether a link is phishing or malware
- Check the URL against the blocklists (safebrowsing, phishtank-lookup) for a quick verdict.
- Look it up in URLhaus and VirusTotal for what it served and how the engines judged it.
- Search urlscan's earlier scans for the page's server, its country and the other domains it loaded, still without visiting it.
Every registry tool here runs on your machine in a sandbox, and ot auto url:… runs all the installed ones on one value.
Before you run one
Is a clean result proof that a link is safe?
No. New phishing pages often live for hours and aren't on any list yet. Treat a clean result as unknown, and look at the domain's age and certificate on the domain page.
Does looking up a URL tip off whoever runs it?
Looking up existing records doesn't: the tools ask the services, not the site. Submitting a new scan to a public service can, because its scanner visits the page and the result may be public; these tools only read what is already there.
Do these tools send my search anywhere?
No. ot runs each tool on your own machine in a read-only container that can only reach the sites the tool declares, and results stay in your results folder. The registry only counts installs.
More from an URL
Archived copiesEmails and contactsLinks and endpointsAll URL tools