Detection, as an API.
Send a link, get back what SafeToOpen sees. Each URL is opened live in an isolated browser running our detection engine, and you receive a clear verdict with the evidence behind it — screenshot, redirect chain, impersonated brand and plain-language reasons. The same engine that powers scan.safetoopen.com.
What you get back for every link
Not just safe or unsafe. Every result explains itself, so your product, your analysts or your customers can act on it straight away.
A verdict you can act on
- Safe, Suspicious, Malicious or Unrated — or “Could not open” when a link is dead
- The finer label too, such as Trusted or Phishing
- The brand being impersonated, with a confidence score
The evidence
- A screenshot of the page as a visitor sees it
- Final URL, page title and HTTP status
- The full redirect chain, with hosting IPs
- Certificate details and the links found on the page
The reasons
- Plain-language findings, ranked high, medium or info
- Every redirect hop checked against our threat intelligence
- Cloaking and certificate problems called out
- Optional: domain age, popularity and a short explanation of the site
How a scan works
A real browser, not a blocklist lookup — so pages no one has reported yet are judged by what they actually are.
Send a link
Post the URL as JSON over HTTPS. Choose desktop or mobile, the page size, and the country to scan from — the US, Canada, the UK, Australia or New Zealand — to see scams that only show themselves to certain visitors.
We open it, safely
SafeToOpen loads the page in an isolated browser running our VisionAI detection, follows every redirect and checks each hop. Internal and private addresses can’t be scanned, and file downloads are identified, not opened.
You get the answer
A full live scan usually takes 15 to 20 seconds, and every scan returns within 60 seconds — the verdict, the evidence and the reasons in one JSON response.
One request, one clear answer
Here’s a simplified result for a phishing page. The field names are the live engine’s; the full reference comes with your access.
{
"verdict": "malicious",
"verdict_title": "Malicious",
"raw_result": "Phishing",
"matched_profile": "microsoft.com",
"confidence": 0.98,
"final_url": "https://login-micros0ft.example/signin",
"http_status": 200,
"redirect_chain": [
{ "url": "https://bit.example/x7Kq",
"ip": "203.0.113.24" },
{ "url": "https://login-micros0ft.example/signin",
"ip": "198.51.100.7" }
],
"alerts": [
{ "level": "high",
"text": "Mentions Microsoft, but isn't microsoft.com." },
{ "level": "medium",
"text": "This page contains 2 known unsafe links." }
],
"domain": { "age": { "age_days": 2 } },
"screenshot": "data:image/jpeg;base64,/9j/4AAQ…",
"elapsed_ms": 15840
}Example only: domains use the reserved .example name and IPs come from documentation ranges.
Built for teams that handle links at scale
Wherever a link arrives before a person trusts it, the API can check it first.
Security operations
Enrich URL indicators in alerts and user-reported emails with a verdict and screenshot, then let your SOAR playbook block, allow or escalate.
Email and messaging
Check the links inside messages before people click them, and show a clear warning with the reason.
Trust and safety
Screen links that customers, sellers or members post on your platform. Fake stores and brand impersonation come back with the brand named.
Security vendors and MSPs
Add live phishing detection to your own product or client portal without building and running a scanning engine.
Private and dependable
Private by design
- Results are returned to you, not kept in a results database
- We analyse to give a verdict, not to build a profile
- Data hosted in New Zealand
Certified and tested
- ISO/IEC 27001:2022 certified
- Independently penetration-tested
- VirusTotal verified vendor
Built to stay up
- 99.5% monthly uptime target for cloud detection and the API
- Service credits if we fall short — see our SLA
- Same engine as the free URL Scanner
Bring SafeToOpen’s detection into your product
Tell us what you’d like to check and roughly how many links a month. We’ll set up access and send you the full API reference.
Questions, answered
It opens any URL you send in an isolated browser running SafeToOpen's detection engine and returns a verdict — Safe, Suspicious, Malicious or Unrated — with the evidence behind it: a screenshot, the redirect chain, the impersonated brand when there is one, and plain-language reasons.
Security operations teams, email and messaging platforms, trust-and-safety teams and security vendors who want live phishing and scam detection without building and running their own scanning engine.
A full live scan usually takes 15 to 20 seconds, because the page is really opened and analysed, not just looked up in a list. Every scan returns within 60 seconds.
Yes. scan.safetoopen.com runs on the same engine, so you can see the kind of result the API returns before you ask for access.
No. When a link leads to a file download, the API tells you it is a file instead of opening it. Links already known to be malicious are still flagged.
API pricing isn't published. Tell us what you'd like to check and roughly how many links a month, and we'll come back with a quote and your access details.