Whack.sh URL Threat Scanner review
A URL-focused threat scanner with multi-network checks, reports, and API access.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Whack.sh URL Threat Scanner checks submitted URLs by loading them in a browser and returning a verdict, risk score, signals, and redirect chain. It is aimed at security researchers, incident responders, SOC analysts, brand-protection teams, and threat-intelligence researchers who need to investigate suspicious links. It is a cloud service with a web app and API, not a downloadable antivirus suite or a tool for scanning a user’s computer.
Its strongest distinction is comparing what a URL serves across network vantage points. Free access uses datacenter egress; paid capabilities add residential and mobile connections, which can help identify content that varies by visitor network. Reports may include screenshots, request logs, HAR data, redirect details, and per-hop IP intelligence such as reverse DNS and ASN. Optional AI-generated plain-English summaries are also available. The service connects with VirusTotal, abuse.ch MalwareBazaar, AlienVault OTX, and worldip.io, and offers CSV, STIX 2.1, and MISP IOC exports.
The Free plan costs $0 per month and includes datacenter egress, the curl-first API, web app, shareable reports, and community support. Pay as you go charges $1 per 100 credits for residential and mobile egress; purchased credits do not expire. Researcher is $30 per month with 3,500 credits, residential and mobile egress, one BYOP proxy, and Split-Horizon Diff. Team Hunter is $100 per month with 12,000 credits, a team workspace, and proxy and vantage-point options; SOC Triage is $500 per month with 62,500 credits and priority egress. Choose Whack.sh for URL investigation and network-based comparisons, but look elsewhere if you need file scanning or computer protection.
Whack.sh URL Threat Scanner pros and cons
- Where it wins
- Compares URL behavior across datacenter, residential, and mobile egress
- Captures redirect chains, screenshots, HAR data, and per-hop IP intelligence
- Exports IOCs in CSV, STIX 2.1, and MISP formats
- Where it doesn't
- Scans URLs only; it does not scan files or a user's computer
- Residential and mobile egress require paid credits or a paid plan
- Anonymous free scans have a 25 MB per-scan limit
Whack.sh URL Threat Scanner fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update