Introduction to urlquery

urlquery shows what a URL does when someone opens it. It loads the URL in an isolated browser and records what the browser requested, received and ran. The evidence is kept in a report you can read, search, share and come back to.

It is built for analysts, incident responders, researchers and anyone defending people against phishing, scams and malicious downloads. You investigate the page through its report, without opening it on your own machine.

How an analysis works

1. Submit a URL on urlquery.net, with the API, or from an agent through MCP. Choose who can see the report: public, restricted or private. See Submitting URLs.
2. urlquery opens it in an isolated browser, follows its redirects, and captures the network traffic, scripts, downloads and a screenshot.
3. Detections run on the captured evidence: network IDS signatures, urlquery's own rules, blocklists and file reputation, and any YARA rules you have written. See Detections and verdicts.
4. The report is ready. Start with its overview, then open the evidence behind it, and pivot to earlier reports that share hosts, IP addresses or content.

What a report contains

Evidence	What it shows
Overview	Submitted and final URL, page title, IP address, tags and alert counts.
Screenshot and page metadata	What a visitor saw.
Redirects and HTTP	Every request and response, with domains, IP addresses and TLS certificates.
JavaScript and response bodies	The code the page ran and the content it loaded.
Downloads and artifacts	Files, archives and their contents, PDFs and shortcuts, with hashes.
Detections	Alerts with their source, verdict and severity, attached to the evidence they fired on.
Technologies and tags	Fingerprinted software, frameworks and services, and report tags.

Reports and evidence explains how to read a report, and Report document describes every field.

Beyond a single report

• Search history. Find earlier reports by URL, host, IP, hash, tag, certificate or content. See Search syntax.
• Check reputation. Look up urlquery's verdict for a URL, or export indicators for your own blocklists. See the Reputation API.
• Pivot on infrastructure. Host Profile finds hosts and IP addresses that share certificates, technologies and other observed facts, and the relations between them. See Host Profile.
• Write your own detections. Your YARA rules scan every new analysis, and you can test a rule against a report before saving it. See YARA rules.
• Work as a team. Team members share restricted and private reports, a plan and API keys. See Plans and features.

Choose an interface

Interface	Use it for
urlquery.net	Interactive work: submitting URLs, reading reports, report and host search, and managing YARA rules.
HTTP API	Scripts, applications and data pipelines: submissions, reports and their evidence, search, reputation, Host Profile and YARA rules.
MCP server	AI assistants and agents doing threat research. The tools return concise evidence and identifiers for follow-up pivots.

All three see the same reports, limited by your account's access. The API and MCP need an API key.

Evidence, not certainty

urlquery's mission is to make web threat activity observable, connected and defensible. It does not replace analyst judgment with a single verdict; it gives you the evidence to reach and defend your own.

A report records one browser visit at one point in time. A page can behave differently by location, device, time or visitor, so a clean result or a lack of detections does not prove a URL is benign. A detection needs context too: shared hosting, third-party content, redirects and stale infrastructure all affect what it means. Corroborate important findings across the page, its network behavior, artifacts, detections, reputation and independent sources.

Choose visibility before you submit. A public report can be seen by every account, and restricted or private visibility doesn't make a sensitive URL safe to submit. Read Safe use and Report visibility before submitting URLs that might contain tokens or personal data.

Next steps

If you want to	Start with
Analyze a URL now	Submit on urlquery.net, then Submitting URLs for the options.
Use the API	The quickstart: authenticate, list reports, read an overview and screenshot, and search history.
Connect an agent	Threat research with MCP.
Detect your own threats	YARA rules and Testing YARA rules.