Reports and evidence
A report is the evidence collected during one browser analysis. It records what urlquery observed, not every behavior the target could exhibit.
Start with the overview
The report overview is the best first request for triage. It contains the submitted and final URL, page title, target IP and ASN, tags, visibility (access), alert counts by source, every contacted host with its network and technologies, and the report ID needed for deeper requests.
Use the full report only when you need its broader structured evidence. The report document page explains every section and what it is good for. Large report sections are also available through focused MCP tools so an agent does not need to process one oversized response.
Evidence categories
| Category | What it helps answer |
|---|---|
| Screenshot and title | What did the page present to a visitor? |
| Redirects and HTTP | Where did the browser connect and what was transferred? |
| Domains, IPs, and TLS | What infrastructure and certificates were observed? |
| JavaScript | What code loaded, executed, or was dynamically written? |
| Resources and files | What content was downloaded and which hashes identify it? |
| Artifacts | What PDFs, archives, Windows shortcuts, Telegram bot tokens, or clipboard behavior appeared? |
| Detections and tags | Which security signals or analyst classifications were attached? See detections and verdicts. |
To see what urlquery has observed about a host across all analyses, not only this one, open its Host Profile from a hostname in the report.
Reports can differ
Two scans of the same URL can produce different results. Pages may vary behavior by time, source IP, browser profile, cookies, referrer, or campaign state. Record the report ID and scan time when citing evidence.
Safe retrieval
Find resource hashes in the full report before retrieving content, and use hashes and metadata when the content is too large or unsafe to handle. The API returns resource content as a download, never for display. MCP resource previews default to 64 KiB and full content is capped at 5 MiB.