✦ AI-powered

Know where a QR code leads.
Or where a link takes you...
Before you tap it.

ScanHawk reads the link hidden inside a QR code — or one you paste or share — and tells you where it really goes. Look-alike domains, punycode spoofs and hidden-destination tricks, caught by deterministic rules — no blacklist required. In a free mobile app, and in an engine any scanner can call.

<800ms
Per-check latency
8
Contexts understood
3
Verdict tiers
The mobile app

Point, scan, and get a straight answer.

Most scanners just open whatever the code points to. ScanHawk shows you a verdict first — and explains it in plain language anyone can act on.

  • Traffic-light verdictEvery code resolves to SAFE, SUSPICIOUS, or DANGEROUS with a 0–100 risk score, shown before anything opens.
  • Plain-English reasoningNot "blocked" — why: brand impersonation, a credential trap, a chain of redirects hiding the real destination.
  • The real destinationShortened and redirected links are traced to where they actually land, so you see the true site, not the disguise.
  • Report & protect othersFlag a malicious code and it goes into our review queue — reviewed, then rolled into the protection everyone gets.
  • Free to useNo subscription, no in-app purchases, no ads. Every scan gets the full verdict, the reasoning, and the redirect trace.
At your desk

The same verdict, in your browser and your inbox.

Phones aren't where most links get clicked. They get clicked at work — in a browser tab and in email — and that's where a bad one costs the most. ScanHawk runs there too, on the same engine, with the same three answers.

Browser extension

Stop the click, not just flag it.

The problem: a phishing link doesn't announce itself. It's a search result, an ad, a link in a chat. By the time the page has loaded, it has already started — and the browser's built-in warning list only knows about sites someone reported days ago.

  • Checks at click timeFollow a link that hasn't been checked and ScanHawk checks it first. A DANGEROUS verdict raises an interstitial before the page loads — the only ScanHawk surface that can block a click.
  • Scan on demandHover a link for a Scan chip, or right-click and choose Scan link with ScanHawk. Hovering never scans by itself.
  • Only the link leaves the browserNever the page, a form, or your selection. The engine key never ships in the extension.
  • Chrome and EdgeOne extension, both browsers.
Microsoft 365 add-in

Catch the link that says one thing and opens another.

The problem: email is where most phishing starts. The link text looks right, the sender looks familiar, and the message passed every filter on the way in. Hovering to read the real address is a habit almost nobody has — and on a phone there's nothing to hover.

  • A banner in the reading paneOpen a message with a dangerous link and the warning is right there, before you've read far enough to be tempted.
  • Every link, with its real destinationThe pane lists each link, what it shows, and where it opens — so "login.microsoft.com" pointing at a look-alike is caught by design, not by luck.
  • Also in Word and ExcelThe same check runs on links in a document or a spreadsheet — including a cell that reads "Invoice" and opens somewhere else.
  • Only the link and its label leave the mailboxNo subject, no sender, no body. What's sent is written down in our privacy policy, and our tests fail if the code drifts from it.
The engine behind it

A reasoning engine, not a lookup list.

A decoded link runs through a layered pipeline. Confirmed-malicious sources are treated as ground truth; everything else is weighed together — deterministic URL rules catch look-alike domains, punycode spoofs and hidden-destination tricks with no blacklist involved, and an AI layer reasons about intent and explains the verdict in plain English.

01 · Decode

Extract

Read the payload, trace every redirect hop to the true final destination.

02 · Inspect

Signals

Domain age, TLS, URL heuristics, and live threat-intel feeds run in parallel.

03 · Reason

AI verdict

Claude judges impersonation, credential traps, and context — the differentiator.

04 · Fuse

Score

Weighted fusion + override floors yield one calibrated 0–100 verdict.

Context-aware  a link on a menu ≠ the same link in an email AI reasoning  explains every verdict in plain English Report a bad link  flag it straight from the verdict screen
For 3rd-party scanners

Any scanner can plug into the engine.

Already built a QR scanner — an app, a kiosk, a point-of-sale reader, a mail gateway? Send the decoded payload to one endpoint and get a verdict back. No model to host, no blacklists to maintain. Scan from your device; let ScanHawk make the call.

check.sh
# Send any decoded QR payload to the engine
curl -X POST https://api.scanhawk.io/v1/check \
  -H "Authorization: Bearer $SCANHAWK_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "http://paypa1-secure-login.xyz/verify",
    "context": "email"
  }'

# ← response
{
  "verdict": "DANGEROUS",
  "riskScore": 96,
  "threatCategory": "phishing",
  "aiReasoning": "Impersonates PayPal on a
     look-alike domain to harvest logins."
}
POST/v1/checkone payload
POST/v1/batchbulk · mail filters
POST/v1/reportfeed the moat
GET/v1/status/:idcached verdict

Pass a contextemail, parking_meter, restaurant_menu, healthcare… — and the engine adjusts how strict it is for where the code was found.

SDKs · JavaScript · Python · Swift · Kotlin

One clear answer

Three verdicts. Zero ambiguity.

SAFE
RISK 0 – 34

No red flags. A known destination with nothing suspicious in the link, the domain, or the page.

SUSPICIOUS
RISK 35 – 69

Something's off — a shortener, a young domain, an odd redirect. Proceed with caution.

DANGEROUS
RISK 70 – 100

A confirmed or strongly-indicated threat: phishing, malware, or credential theft. Don't open it.

Want to know more?

We will send it — nothing else.

An email address or a phone number, tick what you are curious about, one button. No account, no newsletter you did not ask for.

Build on ScanHawk

Put a safety check
behind every scan.

Get an API key and start sending payloads to the engine, or put the app in your users' hands. One integration; every scan protected.