An evidence-led URL scanner comparison
URL Radar, VirusTotal, urlscan.io, URLcheckup and Urlyze help answer different investigation questions. Compare the workflow, the evidence and the sharing policy before choosing where to submit a link.
Written by URL Radar · Reviewed 28 October 2026 · Four relevant services, not a market-share ranking or an independent benchmark.
Start with your question
These are documented capabilities, not a feature-exhaustive scorecard. An unverified feature is not treated as absent. Competitor prices and plan limits are omitted because equivalent current plans were not established.
| Tool | Useful question | Documented evidence / scope |
|---|---|---|
| URL Radar | What happened, why is it concerning, and how can I hand off the evidence? | Free public triage; selected isolated-browser observation. An eligible $4.99 purchase prepares an investigation PDF, fresh browser MP4 and detailed report access. Capture depends on what is observed. Methodology |
| VirusTotal | Corroborate a URL with multiple security vendors. | Aggregates URL/domain security signals and contributor verdicts, with community context. Source: VirusTotal |
| urlscan.io | Inspect browser activity and search related infrastructure. | Records page navigation, contacted domains/IPs, resources, screenshots and DOM; offers searchable scan data. Source: urlscan.io |
| URLcheckup | Inspect a public result with screenshot and clipboard sections. | The reviewed public report includes a screenshot, clipboard outcome, script checks, DOM and network transactions. Source: URLcheckup |
| Urlyze | Investigate interactive threats and broader brand/SOC workflows. | Documents real-browser analysis, multi-stage screenshots and interaction/clipboard evidence on a throwaway page copy. Source: Urlyze |
When to consider it
Corroborate a URL with multiple security vendors.
Useful when you need to compare vendor judgements and investigate disagreements. A detection count needs interpretation; it is not a probability that a page is safe.
VirusTotal: how it works
Vendor documentation reviewed 28 October 2026.
When to consider it
Inspect browser activity and search related infrastructure.
Useful for infrastructure pivots and browser artefacts. It documents Public, Unlisted and Private visibility: choose deliberately before submitting a sensitive URL.
urlscan.io documentation
Documentation and scan-visibility guidance reviewed 28 October 2026.
When to consider it
Inspect a public result with screenshot and clipboard sections.
The linked example reported no copied payload. This establishes the inspected report layout, not what every scan captures. Plans, private submissions and export options were not verified.
URLcheckup: reviewed public report
One public result inspected 28 October 2026; not a full product or pricing audit.
When to consider it
Investigate interactive threats and broader brand/SOC workflows.
Its platform also describes brand/domain protection, IOC/STIX exports and case workflows. Clipboard capture is therefore a shared capability, not exclusive to URL Radar. Plan-specific availability needs checking.
Urlyze platform documentation
Vendor-described capabilities reviewed 28 October 2026; no independent effectiveness benchmark.
Where URL Radar stands out
Choose Radar when you want a straightforward explanation and a portable investigation package at a published one-time price. These are product strengths, not claims that other tools cannot provide similar evidence.
The PDF brings together an executive summary, visual attack path, timeline, command breakdown and response indicators, according to the evidence available.
A fresh isolated-browser recording can retain the transition from a verification lure to keyboard/paste instructions. Full commands and screenshots appear when captured. Captured commands are never pasted or executed.
An eligible webpage report can unlock a professional PDF, compressed 720p MP4 and detailed web tabs. No subscription. The ZIP lasts seven days or five downloads; web access lasts seven days.
Know the limits: free scans are public. Paying does not make the initial scan private. The fresh observation can differ from the free report; no command, attack footage or particular verdict is guaranteed. Private package links grant access to whoever holds them.
A concrete review example
Imagine a page that asks a visitor to verify they are human, then reveals Win + R and paste instructions. The useful evidence is the transition, the copied text and the destination it references—not just the opening screen or a detection count.
Illustrative scenario, not a comparative test. The accompanying 16-second video uses a local synthetic training page and harmless text. It is not live attack footage, and it does not show another scanner failing.
Choose by task
Do not submit confidential, authenticated or secret-bearing links to public scanning services. Check the provider’s submission policy first. urlscan.io’s visibility guide distinguishes Public, Unlisted and Private scans; VirusTotal describes its sharing model. Radar’s public-scan policy applies before any purchase.
Before you choose
That depends on the task. VirusTotal provides aggregated security-vendor context. Radar focuses on explaining bounded URL observations and offering a one-off investigation PDF/browser video package. This comparison does not establish higher detection accuracy, faster scans or broader coverage for Radar.
No. A result describes the evidence a tool could observe at a particular time. Delayed content, targeted delivery, access restrictions and site changes can limit coverage. Review the observation timestamp and limitations rather than treating a score as a safety guarantee.
No. Free reports show the summary and available static visual evidence. Eligible paid packages request a fresh bounded browser observation. Commands and instruction screenshots are included when captured; a recording may show ordinary content or an incomplete flow.
No. The ClickFix Awareness course is a separate educational PDF with five historical examples and a self-scored quiz. It includes no MP4 or accredited certificate. The investigation package is generated for one eligible retained report.
See the evidence first
Review the public summary and available screenshots before choosing a paid package.