Does scanning a link actually open it?

No. Encrata resolves the link server-side through a guarded fetcher and reports where it goes. The URL is always returned as text - it is never something your browser is asked to open, so you can inspect a hostile link safely.

A raw URL, a QR code image, or any image containing links (via OCR). File scanning for uploaded documents and binaries is on the way. Each scan returns the same verdict, risk score and indicators.

What is quishing and how does the QR scan help?

Quishing is phishing delivered through QR codes - a poster or sticker that hides a malicious link. The QR scan decodes the code and scans the destination, so you learn where it points without pointing a phone at it.

Can I feed the results into my own tooling?

Yes. Every scan returns structured indicators of compromise - domains, hashes and URLs - and you can export the findings as STIX to push straight into a SIEM or threat-intel platform.

Is the verdict cached?

Recently scanned URLs and codes can be served from cache. A fresh scan spends the credit; a cached result is free, so repeated checks of the same link do not cost you again.

Where does that
link really go?

Scan links, QR codes and images for phishing and malware - Encrata follows every redirect server-side, so a hostile link never touches your browser.

Examplehttps://developer.encrata.com/api/malware/url/scan

1{
2  "scan_id": "scn_9f2a",
3  "kind": "url",
4  "verdict": "malicious",
5  "score": 92,
6  "category": "phishing",
7  "submitted_url": "http://bit.ly/free-gift-card",
8  "final_url": "https://claim-reward-now.top/login",
9  "redirect_hops": [
10    {
11      "url": "http://bit.ly/free-gift-card",
12      "status_code": 301
13    },
14    {
15      "url": "http://t.co/x8Kd2",
16      "status_code": 302
17    },
18    {
19      "url": "https://claim-reward-now.top/login",
20      "status_code": 200
21    }
22  ],
23  "signals": [
24    "Newly registered destination domain (4 days old)",
25    "Credential form on a look-alike login page",
26    "Multiple cross-domain redirects"
27  ],
28  "credits": 1
29}

Try one

Every malware scan, explained

Catch a hostile link, code or file before someone opens it. Use each scan on its own or chain them into a workflow.

URL scanMalicious · 92

bit.ly/free-gift → t.co/x8Kd2

→ claim-reward-now.top

Redirects3 hops

CategoryPhishing

URL scan

Follow a link to where it really lands - every redirect hop, the final destination and a verdict, without your browser ever opening it.

QR scanQuishing

Decoded → secure-pay-verify.co

PayloadURL

VerdictMalicious

QR code scan

Decode a QR code and scan the URL it hides. Catch quishing posters and stickers before anyone points a phone at them.

Image scan2 links found

OCR → login-update.net

OCR → help-desk.support

SourceScreenshot

ScannedBoth URLs

Image scan

Pull text and links out of a screenshot or image with OCR, then scan every URL found inside it for you.

invoice.pdf.exeMalicious

SHA-256a1b2…7f9c

TypePE binary

Matched a known-bad signature.

File scan

Coming soon

Hash and inspect an uploaded file for known-bad signatures and suspicious traits, and get a clear malicious / clean verdict.

Everything a scan returns

One request gives you a verdict, the evidence behind it, and indicators you can act on.

Select a detail to explore the response

Example response

Verdict

JSON

1{
2  "kind": "url",
3  "verdict": "malicious",
4  "score": 92,
5  "category": "phishing",
6  "category_confidence": 0.98,
7  "final_url": "https://claim-reward-now.top/verify",
8  "redirect_hops": [
9    {
10      "url": "https://bit.ly/free-gift",
11      "status_code": 301
12    },
13    {
14      "url": "https://claim-reward-now.top/verify",
15      "status_code": 200
16    }
17  ],
18  "decoded_url": "https://claim-reward-now.top/verify",
19  "raw_payload": "https://claim-reward-now.top/verify",
20  "signals": [
21    "Recently registered domain",
22    "Brand impersonation"
23  ],
24  "indicators_of_compromise": {
25    "domains": [
26      "claim-reward-now.top"
27    ],
28    "hashes": [
29      "a1b2c3…"
30    ],
31    "urls": [
32      "https://claim-reward-now.top/verify"
33    ]
34  },
35  "stix_export": {
36    "available": true,
37    "format": "STIX 2.1"
38  }
39}

Illustrative schema and sample values

Ready-made malware workflows

Drop a scan into the moments that matter - inbound links, printed QR codes and user uploads.

Inbound link screening

Scan links in messages before a human ever clicks them.

A link arrives in email or chat
Scan the URL and its redirects
Flag if it is malicious
Quarantine or block delivery

QR poster verification

Check where a printed QR code really points before you trust it.

Upload a photo of the code
Decode the hidden URL
Scan the destination
Approve only when clean

User-upload scanning

Vet files and screenshots users send you before you store them.

A user uploads a file or image
Hash and inspect it
Detect known-bad signatures
Store only what is safe

Simple, credit-based pricing

One credit per scan, no monthly fee. Repeat scans of the same target are served from cache and cost nothing.

Scan	Details	Credits	Rate limit
URL scan	Resolve a link, follow redirects and score the destination	1 credit	200/min
QR code scan	Decode a QR image and scan the URL it hides	1 credit	200/min
Image scan	OCR an image and scan every link found inside	1 credit	200/min
File scan	Inspect an uploaded file for known malicious signatures and suspicious traits	1 credit	200/min

Common questions

Should you have any questions, our team is at your service.

Built for
humans and AI

Start with 500 free credits

$curl https://developer.encrata.com/api/malware/url/scan -H "Authorization: Bearer YOUR_API_KEY" -d '{"url": "http://bit.ly/free-gift-card"}'

Where does thatlink really go?