Is this website a scam?

Yes. We never execute the URL on your machine — scanning happens in sandboxed infrastructure on our side. Your IP is not stored against the scan; it's used only for anti-abuse rate limiting and discarded once the quota window passes.

Three of the six layers are genuinely slow: spinning up a URLScan sandbox to render the page (7–15s), getting vendor verdicts back from ~90 AV engines (variable, up to 20s), and the AI analyst doing open-web research (5–10s). We run them in parallel and tail-latency-cap each one so a single slow source doesn't hold up the rest.

Yes. A completed report is permanent and is never rescanned automatically. Opening or sharing it consumes no VirusTotal or AI quota. A fresh analysis runs only when someone explicitly requests a rescan from the report UI.

If you just need a yes/no on whether a link is phishing, the Phishing Link Analyzer is 10× faster (sub-3s). Use this full scanner when you want the forensic deep-dive — AV engine consensus, sandbox render, domain-history context, brand reputation — or when the fast check returns suspicious and you want a second opinion.

The sandbox render will see whatever an unauthenticated visitor sees — usually the login wall or paywall page. That's useful for catching credential-harvest pages, but it means we can't scan content behind auth. For paywalled-only threats, attach a screenshot to the report comment thread and moderators can weigh in.

Every report page has a comment thread — leave a note there. Moderators triage comments and can apply overrides when warranted. For suspected false positives, we cross-check against the AV vendor's own database and reach out if the misclassification is clear-cut.

Guests get 20 scans per hour; signed-in members get higher quotas. A bulk API is on the roadmap — today the scanner is designed for one-at-a-time interactive use. If you need bulk access for research or SOC work, open a forum thread and we'll work with you directly.