Skip to content
AI Marketplaces Leaderboard

ScanMalware

ChatGPT plugin

Phishing URL scans and pivots

View in ChatGPT directory

ScanMalware helps security teams investigate suspicious and phishing URLs. It renders a URL in a sandboxed browser, records what the page loaded and did, and keeps public scans in a searchable archive, so one reported phishing page can lead to the rest of its campaign.

With this plugin you can:

  • Look up what the archive already knows about a domain, URL or IP address: the scanner's verdict and risk factors, network requests, indicators, TLS and JARM details, detected technologies, YARA matches, OCR text and RDAP data.
  • Find related scans by domain, IP, ASN, JARM signature, favicon hash, screenshot hash, fuzzy hash, OCR text, tracking key or JavaScript fingerprint.
  • Look up Certificate Transparency records for a domain or IP.
  • Submit a new URL for scanning, choosing whether the result is public or unlisted, and read the verdict when the scan completes.

The included skill walks through pivoting from one phishing URL to its sibling hosts, and avoids two common mistakes: giving a domain a verdict that belongs to a page that only redirected to it, or to another tenant on a shared hosting platform; and blocking on shared IP addresses or TLS fingerprints that describe a hosting platform rather than an attacker.

ScanMalware is a defensive tool. Pages are opened in ScanMalware's isolated browser, not on your device. No account or API key is needed. 126 of the 128 tools only read data; the two that write submit a URL for scanning and record a safe or malicious vote on a scan. A public scan publishes the URL and its results, so use "unlisted" for confidential targets.

ScanMalware is operated by Triop AB in Sweden.

Featured
No

not on the featured shelf

Movement

From our daily snapshots over the last 30 days.

Rank by placement

#8223of 8,793322places down24h—7d
#7,673#7,823#7,973#8,123#8,273Sep 27Oct 3Oct 9Oct 15Oct 21Oct 26

Rank in Security

#61of 661places down24h—7d
#59#60#61Sep 27Oct 3Oct 9Oct 15Oct 21Oct 26

In its category

How this plugin compares with others in the same category. Positions are counted within the category, not across the whole directory.

Security61st of 66 by placement
#PluginPosition7d
59Streamingo Face Blur#76741,030places down
60ArrowMem#8047—
61ScanMalwareThis page#8223—
62Have I Been Squatted#8226—
63ScamCheck#8399—

All 66 Security plugins

Also on other marketplaces

Example prompts

  • “Check this suspicious link in ScanMalware and summarize what the page does.”
  • “Find other phishing pages that reuse this page's favicon or scripts.”
  • “Scan this URL as unlisted in ScanMalware and report the verdict.”

Skills

  • pivoting-phishing-infrastructure-with-scanmalware

    Expands one phishing URL into its wider campaign using the ScanMalware public scan archive (no API key needed): redirect-aware domain history (matched_on), SMQL searches on each kit artifact (script SHA-256, favicon MMH3, screenshot hash, page title) plus JARM and IP, and CT-derived subdomains, then judges which pivots are selective enough to hunt or block on. Use when a reported phishing URL needs its sibling hosts found, when checking how an already scanned page was judged, or when a verdict must be attributed to the right host after a redirect. Keywords: ScanMalware, SMQL, matched_on, final_url, js_sha256, favicon_hash, dhash, jarm, CONFIRMED_SCAM, phishing kit, scanner cloaking.

Categories
Made by
Triop AB · Website
Sign-in
On Install
Capabilities
Read, Write
Availability
Available
Version
1.0.0
Keywords
phishing, threat-intelligence, url-scanning, osint, security, mcp
Created
October 8, 2026
More info
Sponsorship
Promote this plugin