URL inspection submission policies
Dated 24 October 2026. This table describes checked sources; it does not scan a URL or tell you whether a site is safe. Unknown fields are preserved.
22 of 22 rows
| Service and mode | Who sees submissions | Retention | Third-party sharing | Account | Private option |
|---|---|---|---|---|---|
| urlscan.io Public, Unlisted and Private URL scans | Public: searchable. Unlisted: vetted Pro researchers. Private: submitter and people given the scan ID. | Public retention not guaranteed; paid custom periods available. Private expiry is not quantified here. | Terms exclude Private URLs from third-party sharing; submitters can still disclose a scan ID. | Account and API-key model documented; universal account requirement not established. | Private mode exists; sharing its scan ID grants access. |
| VirusTotal Standard service contrasted with paid Private Scanning | Standard reports reach the public community and examining partners; Private reports are organization-visible. | Private default is usually 24 hours and configurable; standard retention not established. | Private submissions are not shared unless also uploaded to the standard service; standard results reach examining partners. | Private requires specific privileges; standard account requirement not established. | Paid Private Scanning is a separate offering. |
| Cloudflare URL Scanner Radar URL Scanner API; Public and Unlisted | Public by default; Unlisted is accessible to anyone knowing the scan ID. | Successful scans: 12 months. Failed scans: deleted after 30 days. | Unknown | API token required for API submission. | Unlisted option documented; it is not authenticated private access. |
| Google Web Risk Lookup API, contrasted with Update API | Lookup sends the queried URL to the server. | Unknown | Unknown | Unknown | Unknown |
| Sucuri SiteCheck Free SiteCheck; separate from paid website monitoring | Unknown | Unknown | Unknown | Free remote scanner available to anyone; no explicit account rule stated. | Unknown |
| ANY.RUN Public and Private sandbox submissions | Public submissions reach all users and third-party services. Private visibility follows the selected audience. | Unknown | Public submissions are available to third-party services; a comprehensive Private sharing promise was not established. | Unknown | Private choices include Only me, Team and Who has a link. |
| Hybrid Analysis Public service terms and data-protection pages | Submitted URLs and reports are public by default; the security community can access them. | Unknown | Submitted content is available to commercial companies and cybersecurity partners. | Registered users can generate a free Public API key; universal web-submission requirement is unstated. | Public service terms require public sharing; a private option is not established. |
| Joe Sandbox Cloud Basic only | Basic samples and their analysis results are accessible to anyone. | Unknown | Basic terms allow sharing, sale/licensing and access by other organizations. | Unknown | Basic samples are public; no private Basic submission is described. |
| URLQuery Public, restricted and private analysis visibility | Public reports reach all users; restricted/private visibility depends on available account settings. | Necessary for analysis and operational stability; no fixed duration stated. | Public/restricted may reach trusted security partners; Private analysis is excluded from those partners. | Unknown | Restricted or private settings are described; availability is account-dependent. |
| PhishTank Community reporting and validation | Community submission, validation, tracking and sharing. | Unknown | Phishing data is shared; recipients and full payload distribution are not specified by this FAQ fragment. | Registration is required for reporting; current registration availability was not tested. | Unknown |
| Criminal IP Domain search and member service | Recently scanned reports are publicly viewable; user search histories are private. | Unknown | Unknown | Free Membership follows account creation; anonymous lookup entitlement remains unstated. | Paid private domain scans are documented. |
| ImmuniWeb Web Security Community Web Security test | Unknown | Unknown | Unknown | Unknown | A Hide from Latest Tests control is documented; confidentiality is not established. |
| Norton Safe Web Website community and site-owner features | The website provides community ratings and comments; raw lookup visibility is not specified. | Unknown | Unknown | Norton Account required for community participation and site-owner features. | Unknown |
| EmailVeritas URL Checker URL Checker policy | Operator stores the submitted URL; public report visibility is not stated. | URLs remain with associated content and results; no numeric retention period is stated. | No sale/rental/disclosure promise has stated legal, rights-enforcement and system-integrity exceptions. | Unknown | Unknown |
| Lionic URL Check URL Check; general applications/services privacy notice | General policy says URLs reach a cloud web-categories engine; URL Check-specific audiences are not defined. | Unknown | Unknown | Unknown | Unknown |
| CheckPhish Public URL checker; API statement separately scoped | Unknown | Unknown | API page says scanned URLs and data are not shared or sold; public checker scope is unstated. | Unknown | Unknown |
| MDN HTTP Observatory Current HTTP Observatory, formerly Mozilla Observatory | Each domain’s scan history is public. | Unknown | FAQ says user data is not stored with each scan; it does not define all third-party report sharing. | Unknown | Current FAQ describes public scan history; it does not establish a confidential private-result option. |
| Netcraft Site Report Queried URL/hostname/domain and threat-indicator handling | Netcraft may visit the queried address immediately or later; public visibility is not specified. | Unknown | Threat-indicator data may be shared to combat cybercrime; this is not a statement that every query is shared. | Unknown | Unknown |
| Google Safe Browsing API v4 Lookup; API terms dated November 2025 | Lookup sends queried URLs to Google servers. | Unknown | API terms permit sharing submitted URLs, content and metadata with third parties. | Google Account, Developer Console project and API key required. | Unknown |
| Dr.Web Link Scanner Online link scanner; general company privacy policy | Unknown | Unknown | Unknown | Unknown | Unknown |
| FortiGuard Web Filtering Public web-rating lookup; general Fortinet policy | Unknown | Unknown | Unknown | Unknown | Unknown |
| Trend Micro Site Safety Center Public Site Safety Center; global privacy notice | Unknown | Unknown | Unknown | Unknown | Unknown |
No rows match. Clear a filter or use Reset.
All rows are present in the HTML. Filtering uses this table only. Provider links open official guidance; no report is submitted here.
JSON · Method · Source ledger