Read clean, unknown and unfinished URL results

Reference Last checked 25 October 2026

A clean-looking URL report establishes only what its named check found, about its stated subject, at its recorded time. No match, no opinion, expired evidence, a failed request and unfinished analysis are different outcomes. None supplies a general certificate that a link is safe to open.

Start with the result state

The table translates documented provider states into narrow conclusions. It does not replace a provider’s wording or invent a common scoring scale. The reading date is 25 October 2026 throughout. Keep the provider, API version and original field beside any translated label so another reader can recover the distinction.

“Stale” is deliberately an editorial description here, not a fabricated provider status. It can mean that a documented cache lifetime expired, or that an observation is older than the decision being considered. Those are separate reasons. Record which applies rather than assigning every provider a universal maximum age.

Check the subject before the adjective

Consider the inert address https://example.test/accounts/invite. A report about example.test, a report about that complete URL and a report about a downloaded file answer different questions. Removing the path before comparing reports changes the subject. So does replacing a redirected address with its starting address without saying that a redirect occurred.

Write down what was actually checked before interpreting the colour or badge. Useful fields are the original subject, its type, the provider, the operation and any returned scope. A hostname-only observation cannot silently become a statement about every page, attachment or account flow underneath it. Likewise, a file result does not authenticate the website that distributed the file.

The hostname guide helps separate the address components. The report reader shows why source, time, scope and state belong together. Neither tool adds reputation information to the address it displays; parsing text and obtaining an external verdict are separate operations.

No match and no opinion need different wording

For a successful Safe Browsing v5 lookup, an empty threat collection is the documented no-match response. Its matching procedure includes limited host-suffix and path-prefix expressions, so describe the API’s search rather than promising that only one literal string was compared¹. That is narrower and more accurate than saying that the service inspected every aspect of a website.

VirusTotal’s URL schema distinguishes undetected from harmless and preserves each contributor’s raw result alongside a normalized category². Replacing both with the word “clean” discards information. A reader then cannot tell whether an engine expressed a favourable view or supplied no opinion at all.

Our recommended wording is correspondingly modest: “No match returned by this lookup,” or “This contributor supplied no opinion.” Neither sentence needs a percentage. A list of absent opinions should remain visible as missing opinions, rather than swelling a denominator labelled successful checks. Preserve any returned adverse result separately instead of averaging it away.

Read time as part of the evidence

A report can have several useful dates: the analysis time, the time its record changed and the time someone read it. They are not interchangeable. Opening an old report today does not move its underlying observation to today. A page refresh can retrieve the same historical record without inspecting the destination again.

urlscan specifically describes existing scans as point-in-time snapshots that are not re-crawled⁴. For that kind of record, retain the original scan time and explain what changed, if anything, after it. An old report can remain useful for documenting a previous incident while being inadequate evidence for the site’s present contents.

A cache deadline answers a different question: how long the client may reuse a response under that API’s rules. It is neither the service’s report-retention period nor a promise that the destination cannot change. When a deadline expires, describe the cached result as expired evidence; do not silently renew it because the report page remains available.

There is no age cutoff applied to every record on this page. The made-up stale example below carries an explicit expiry so its interpretation is reproducible. If a real record provides only a date, keep that date and explain the missing freshness information. Do not invent an expiry merely to produce a red or green status.

Failed and pending work supplies no completed verdict

A timeout records an interrupted attempt, not a successful negative result. A request rejected before analysis, a service error and a result that cannot be retrieved also need their own explanations. Preserve the actual error and the operation that failed: a failure to retrieve an artifact is different from a provider reporting that analysis failed.

VirusTotal documents queued analysis as having empty results and statistics, while in-progress analysis can have partial output⁵. The presence of an analysis identifier therefore establishes less than a completed report. If a display has only partial results, state that directly and avoid presenting its count as the final outcome.

HTTP status codes also need their endpoint context. urlscan documents 404 while a submitted scan’s result is unfinished, and 410 after deletion⁶. That specific workflow does not make every 404 on the internet a pending scan. An unavailable screenshot similarly is not evidence that the destination produced a blank page or contained nothing concerning.

Work through five fictional records

These records are teaching examples, not copied reports or responses from real services. Their only address is the reserved name https://example.test/start. The JSON download labels every record synthetic and keeps the source definitions separate from the invented values: fictional result records.

Record A can be described without claiming that B agrees with it. Record B contributes an absence of opinion. Record C preserves an earlier observation but cannot be relabelled current. D and E differ because an interrupted request and waiting work have different operational meanings. None of these differences identifies the contents of the fictional destination.

Suppose a dashboard turns all five into a single green label because none contains a positive detection. That display has collapsed three kinds of missing evidence and one expired observation into agreement. The repair is to retain the separate states, not to assign them more elaborate weights. A clear sentence is more informative than an unsupported confidence score.

Compare reports without cancelling evidence

It also helps to keep execution state separate from verdict. A completed report can contain both an adverse finding and an engine timeout. “Completed” describes the overall workflow; it does not erase the timeout or prove that every possible check succeeded. Conversely, an unfinished report can already contain a finding that should not disappear merely because the final count is unavailable.

Treat availability, freshness and conclusion as separate fields when writing a summary. A report can be available but old, current but incomplete, or complete with no opinion from a particular contributor. One label cannot reliably express all three dimensions. Keeping them separate also lets a later update replace the relevant field without rewriting the historical observation.

For example, if Record D later gains a completed result, retain the fact that its earlier attempt timed out when documenting that earlier decision. If Record C receives a new observation, identify the new observation rather than extending the old expiry by hand. These are record-keeping choices for the fictional examples, not claims that any provider stores its history in this format.

When two records appear to conflict, first compare subjects, operations and observation times. Then compare the provider’s category definitions. A domain classification and an exact-URL snapshot can both be accurately reported without answering the same question. The disagreement guide develops that comparison with examples of scope and collection context.

Do not treat a second report as permission to ignore a browser warning. Google expressly acknowledges both missed threats and false positives in its Safe Browsing usage guidance⁷. Establishing which applies to an actual incident requires evidence beyond this table. Owners can use the documented warning-review routes without turning a missing or favourable report into a warning-bypass instruction.

For a useful handoff, keep the returned wording, relevant dates and uncertainty together. If a field is absent, say “not supplied.” If an operation was not performed, say “not performed.” If another person would have to disclose a sensitive address to get more evidence, record that dependency rather than quietly submitting it on their behalf.

Not covered on this page

• A verdict about any real address or downloaded file.
• Provider accuracy, detection rates or a universal freshness deadline.
• Instructions for bypassing a browser warning.
• New scans, submissions, reports or appeals.