- urlscan.io scans a suspicious link in its own browser and shows what happens.
- A public scan can be seen by anyone, including search engines.
- Researchers found password reset links and invoices exposed in public scans.
- Scans can also be set to unlisted or private to limit who sees them.
- One public scan flagged a fake Ledger crypto site as malicious.
urlscan.io is a tool that checks a suspicious link for you. It opens the link in its own browser and shows you a report of what the page does. The site says you pick whether each scan is public, unlisted or private before you submit it. A public scan can be found by anyone later, even if the link was meant to stay private.
A public scan from August 26, 2026 flagged a fake site that copied Ledger's crypto wallet pages as potentially malicious. urlscan.io says the page was built to look like Ledger's real site, right down to its wallet and card pages. That's the kind of report a public scan makes visible to anyone who looks.
Each report lists the redirects a link makes, the other addresses it talks to, and its security certificate. Positive Security, a research group that studies data leaks, says a full report can include a screenshot and the page's full underlying code. urlscan.io says it also checks links against about 500 well known brands to spot copycat sites.
urlscan.io lets you set each scan to public, unlisted or private. A public scan shows up on the site's front page and in search results anyone can browse. An unlisted scan skips the front page but can still be found by security companies that pay for urlscan's Pro service. A private scan is visible only to you, or to your team if you're on one.
urlscan.io scan visibility settings
Positive Security found that public scans have leaked sensitive links before, including password reset pages, signed documents and paid invoices. In one case, GitHub accidentally sent private GitHub Pages sites to urlscan.io for scanning, exposing their names. Positive Security also sent test emails to leaked addresses and found that about half of them triggered an automatic public scan of the test link.
Positive Security urlscan data leak report
After that report, urlscan.io added rules that delete matching scans, made the default visibility setting easier to find, and let teams cap how public a scan can be. The company also says it will remove a domain's scans on request and take down a single result if you flag it with the Report button.
