A professional Firefox extension that integrates multiple security analysis tools directly into your browser's context menu. Analyze suspicious links with URLScan.io, VirusTotal, and AbuseIPDB, check domain age via RDAP, pivot to external threat intelligence sites, and block malicious domains with NextDNS — all from a right-click.
Built for triaging spam, scam, and phishing links (e.g. from the junk folder in Outlook or Gmail on the web): analyze how an attack works, then block the domains behind it.
- 🔒 URLScan.io Integration: Comprehensive website security scanning, with a batch scan queue
- 🧪 VirusTotal Integration: URL analysis with 70+ antivirus engines and blocklist services
- 🛰️ AbuseIPDB Integration: IP reputation checks with automatic domain→IP resolution
- 📅 Domain Age (RDAP): Registration date lookup — flags recently registered domains, a common phishing signal
- 🔎 Pivot Lookups: One-click search on Talos, IBM X-Force, ScamAdviser, urlscan.io, VirusTotal, and Google Safe Browsing
- 🛡️ NextDNS Integration: DNS-level blocklist/allowlist management
- 📱 Multi-Profile Support: Manage multiple NextDNS profiles, including "All Profiles" at once
- 🔕 Notification Levels: All / Errors only / None — no toast spam during large batch scans
- ⚙️ Easy Configuration: Settings page with per-service Test Connection buttons and quota display
- 🔐 Secure Storage: API keys stored locally in Firefox's secure storage
- Detailed website security analysis with screenshots and HTTP request inspection
- Malware and phishing detection; results open automatically
- Scan Queue: add URLs throughout the day, process them all at once (rate-limited)
- Submits URLs for analysis by 70+ engines
- Polls until the analysis completes, then opens the results page
- Checks IP reputation based on community abuse reports (last 90 days)
- Automatically resolves domains to their IP via DNS-over-HTTPS
- Shows abuse confidence score, report count, ISP and country; opens the details page for reporting
- Queries the official registry RDAP service (no API key needed)
- Warns when a domain was registered less than 6 months ago
- Talos Intelligence, IBM X-Force Exchange, ScamAdviser, urlscan.io search, VirusTotal domain page, Google Safe Browsing transparency report
- Add domains to blocklists (DNS-level blocking) or allowlists
- Per-profile or all profiles at once
- Instant network-wide protection
- Download the latest release
- Open Firefox and navigate to
about:addons - Click the gear icon and select "Install Add-on From File"
- Select the downloaded
.xpifile
- Clone this repository
- Open Firefox and navigate to
about:debugging#/runtime/this-firefox - Click "Load Temporary Add-on"
- Select any file in the extension directory
URLScan.io:
- Register at urlscan.io
- Get your API key from the profile page
VirusTotal (Optional):
- Register at virustotal.com
- Get your API key from your API key page
- Free tier: 4 requests/minute, 500/day
AbuseIPDB (Optional):
- Register at abuseipdb.com
- Get your API key from account API settings
- Free tier: 1,000 checks/day
NextDNS (Optional):
- Register at NextDNS
- Get your API key from account settings
Domain Age (RDAP) and Pivot Lookups require no account or API key.
- Click the extension icon → Settings, or right-click → Security Analysis → Configure Tools
- Enter your API keys and click each Test Connection button — this also grants the required host permission (Firefox will show a one-time permission prompt for VirusTotal and AbuseIPDB)
- Choose scan visibility for URLScan.io (Public/Unlisted/Private) and customize tags
- Set your preferred notification level (default: Errors only)
- Click "Save All Settings"
Right-click any link (or selected text) → Security Analysis:
- URLScan.io → Scan Now, or Add to Scan Queue / Process Queue for batches
- VirusTotal → Scan Now
- AbuseIPDB → Check IP Reputation
- NextDNS → Add to Blocklist / Allowlist (per profile or all)
- Domain Age (RDAP) → registration date and age notification
- Lookup on… → open the domain on an external analysis site
- Version: 3 (Manifest V3)
- Minimum Firefox: 142.0+
contextMenus: Right-click menu integrationactiveTab/tabs: Open results in new tabsstorage: Securely store user settingsnotifications: Scan status and lookup resultshttps://urlscan.io/*: URLScan.io APIhttps://api.nextdns.io/*: NextDNS APIhttps://www.virustotal.com/*: VirusTotal API (granted on first use)https://api.abuseipdb.com/*: AbuseIPDB API (granted on first use)
Note: Firefox MV3 treats host permissions as opt-in. The Test Connection buttons in settings request the permission with a one-time prompt. RDAP (rdap.org) and DNS-over-HTTPS (dns.google) need no host permission because those services support cross-origin requests.
- URLScan.io (API v1):
POST /api/v1/scan/, pollingGET /api/v1/result/{uuid}/, quota check via/user/quotas/ - VirusTotal (API v3):
POST /api/v3/urls, pollingGET /api/v3/analyses/{id} - AbuseIPDB (API v2):
GET /api/v2/check - NextDNS (API): profile list and denylist/allowlist management
- RDAP (rdap.org): registry bootstrap for domain registration data
- Google DNS-over-HTTPS (dns.google): domain→IP resolution for AbuseIPDB checks
- Right-click a link → Scan with URLScan.io (or queue it)
- Extension submits the URL to the urlscan.io API
- Initial 10-second delay, then polls every 2 seconds (up to 40 seconds)
- Opens the results page automatically when ready
- Queue processing waits 2.5 seconds between scans to respect rate limits
- Local Storage Only: API keys are stored exclusively in Firefox's secure local storage
- No Third-Party Sharing: API keys are only ever sent to their own service (urlscan.io key to urlscan.io, etc.)
- User Control: You control URLScan visibility (public/unlisted/private) and notification level
- Domain lookups: RDAP and DNS-over-HTTPS lookups only transmit the domain being checked
- Open Source: All code is available for inspection
- ✅ ESLint validated
- ✅ Modern ES6+ JavaScript
- ✅ Comprehensive error handling
- ✅ JSDoc documentation
- ✅ Input validation
- Load the extension temporarily in Firefox (
about:debugging) - Configure API keys in the options page and use the Test Connection buttons
- Right-click links and test each integration
- Verify notifications respect the configured notification level
- Confirm results pages open automatically
- 🦊 New permanent add-on ID (firefox@paulrutten.nl) ahead of AMO submission
- 🔒 Removed remote Google Fonts stylesheet from options page (AMO policy; falls back to system fonts)
- 📝 Updated contact email to securitytoolkit@paulrutten.nl
- ☕ Added Buy Me a Coffee support link
- ✨ Added AbuseIPDB integration (IP reputation check with automatic domain→IP resolution, opens details page for reporting)
- ✨ Added Domain Age check via RDAP — flags recently registered domains (a common phishing signal)
- ✨ Added "Lookup on…" pivot submenu: Talos, IBM X-Force, ScamAdviser, urlscan.io search, VirusTotal domain, Google Safe Browsing
- ✨ Test Connection buttons for URLScan.io and VirusTotal (with quota display)
- 🔐 Runtime host-permission requests for new integrations (Firefox MV3)
- ✨ Added VirusTotal integration (scan URLs, auto-open results)
- ✨ Added notification level setting (All / Errors only / None) — default "Errors only" to reduce toast spam during batch scanning
- 🎨 Added NextDNS and VirusTotal icons to the context menu
- 🐛 Fixed single-profile NextDNS blocklist menu doing nothing (broken condition)
- ✨ Added NextDNS integration
- ✨ Added blocklist/allowlist management
- ✨ Dynamic profile loading and selection
- ✨ Reorganized context menu with "Security Analysis" parent
- ✨ Added profile display in settings
- 🎨 Enhanced UI with NextDNS configuration
- 📝 Comprehensive documentation for NextDNS
- 🔄 Menu structure supports future integrations
- ✨ Upgraded to Manifest V3
- ✨ Added customizable tags feature (defaults: firefox, extension)
- 🐛 Fixed polling delay bug
- 🎨 Complete UI redesign with urlscan.io branding
- 🔐 Added API key show/hide toggle
- ✅ Added comprehensive input validation
- 📝 Improved error messages and user feedback
- 🏗️ Better code structure with JSDoc comments
- ♿ Added accessibility improvements
- Initial release
- Basic URL scanning functionality
- Context menu integration
- Settings page
Developer: Paul Rutten (securitytoolkit@paulrutten.nl)
If you like my work and want to support it (or my rampaging coffee addiction), consider making a donation via ☕ Buy Me a Coffee.
Powered by:
- urlscan.io - Website security scanner
- VirusTotal - Multi-engine URL and file analysis
- AbuseIPDB - Community-driven IP abuse reports
- NextDNS - DNS-level security and privacy
- RDAP - Registry data access protocol
- Google Public DNS - DNS-over-HTTPS resolution
- Cisco Talos, IBM X-Force, ScamAdviser, Google Safe Browsing - Pivot lookup sources
This extension is provided as-is for use with the integrated services. Please refer to each service's terms for API usage guidelines: urlscan.io, VirusTotal, AbuseIPDB, NextDNS.
For issues or questions:
- Email: securitytoolkit@paulrutten.nl
- Support the project: ☕ Buy Me a Coffee
- API documentation: urlscan.io | VirusTotal | AbuseIPDB | NextDNS