Check anything before you click it.
Truscan checks URLs, domains, IPs, files, hashes, images, QR codes and barcodes for malware and phishing — and tells you why, not just a score.
$ curl -s https://api.truscan.co/api/url/scan \
-d '{"url":"http://paypal-verify-account.tk/login"}'
{
"success": true,
"result": {
"verdict": "suspicious",
"score": 47,
"signals": [
{ "source": "url_heuristics",
"detail": "the domain mentions \"paypal\" but the site
is not owned by paypal" },
{ "source": "domain:domain_age",
"detail": "the domain is not present in any registry" }
]
},
"message": "This looks suspicious. Treat it with caution."
}Eight things it checks
Each one is owned by a service that does nothing else, so a scan is only ever as slow as the checks it actually needs.
URLs
Follows every redirect to the real destination, then reads the page it serves — credential forms, brand impersonation, hidden frames.
/api/url
Domains
Registration age, registrar, nameservers and mail records. A domain registered this morning is the single strongest free signal there is.
/api/domain
IP addresses
Who announces the address, which country it sits in, whether it resolves backwards, and whether it appears on published blocklists.
/api/ip
Files
What a file really is, not what it claims. Catches double extensions, macros, packed payloads and anything hidden inside the container.
/api/file
File hashes
Look up an MD5, SHA-1 or SHA-256 against the malware corpus without uploading anything at all.
/api/hash
Images
Decompression bombs, appended executables and polyglots — plus the EXIF and GPS a picture reveals about whoever sent it.
/api/image
QR codes
Decodes the symbol and checks where it actually leads, including the payloads that join a WiFi network or open a payment.
/api/code
Barcodes
Code 128, Code 39, ITF, Codabar, EAN and UPC, read at any orientation — the same decoder, the same verdict.
/api/code
How it works
- 1
Submit anything
Paste a link, drop a file, or upload a photo of a QR code. No account needed.
- 2
We check it properly
Redirects are followed in a sandboxed fetcher that refuses to touch private networks. Files are parsed without ever being executed.
- 3
You get a reason
Not just a score — every individual check that ran, what it found, and what it means, in plain language.
A note on honesty. When we can't reach something, or nothing is known about it, Truscan says so — it does not report “clean”. A scanner that guesses is worse than no scanner, because you'd trust it.
One envelope, every endpoint
Every response has the same shape, so you write the parsing once. A failure carries a machine-readable code and a real HTTP status — never a 200 with an error inside it.
Same route, both credentials
A protected endpoint accepts a dashboard session or a
tru_API key. There is never a second, key-only route to keep in sync.Keys you can actually revoke
We store a fingerprint, never the key. Revoking one drops its cached identity in the same call, so it stops working immediately rather than whenever a cache expires.
// success
{
"success": true,
"result": { "verdict": "clean", "score": 0 },
"message": "No threats found."
}
// failure — with a real status line
{
"success": false,
"result": { "code": "rate_limited" },
"message": "You've made too many requests.
Please wait a minute and try again."
}Free while we build it
No trial, no card, no request cap you discover halfway through.
Free
Everything the scanner can do, for everyone.
£0forever
- All eight capabilities
- 60 requests per minute
- The full JSON response
- No sign-in, no card
Pro
Higher limits and usage attribution, when the paid tier opens.
—not yet available
- Raised rate limits
- API keys with per-key usage
- Scan history and retention
- Priority provider lookups