Virus & malware scanning · as an API

The antivirus API
for developers.

POST a file or URL to one REST endpoint. Get back a JSON verdict, scored by multiple commercial scan engines running in parallel. Built for the teams who ship file uploads.

Start free trial Read the docs 14-day trial · no card required
99.9%
Uptime
Multi engine
Per scan
3 regions
US · EU · APAC
scan.sh
live
$

Works with the stack you already run
AWS
Azure
Google Cloud
Heroku
Salesforce
Vercel
Railway
Fly.io
DigitalOcean
Amazon S3
Azure Blob
AWS
Azure
Google Cloud
Heroku
Salesforce
Vercel
Railway
Fly.io
DigitalOcean
Amazon S3
Azure Blob
How it works

From zero to scanning in three steps.

01
Sign up, grab a key
Start a 14-day free trial, no card required. Your API token is waiting in the dashboard.
$ export API_TOKEN=as_live_…
02
POST a file or URL
Send the bytes directly, or point at a URL we can fetch. Works with any language that speaks HTTP.
curl -F "file=@upload.pdf" \
  https://api.attachmentscanner.com/v1.0/scans
03
Get a JSON verdict
Every scan returns a clear status and matches array, scored by multiple commercial engines in parallel.
{ "status": "ok", "matches": [] }
Multi-engine detection

One antivirus API.
A jury of engines.

Most virus scan APIs run a single engine. We run multiple commercial antivirus engines in parallel on every request — and include them all on every plan. A second and third opinion on every upload, for the price of one.

Simple, predictable plans

Fixed monthly scan allowance, fixed price. No per-engine add-ons, no enterprise-sales gate just to scan production traffic.

Heuristic & signature-based

We combine signature matching with heuristic detection, so novel malware has more surfaces to trip on before it reaches your users.

One verdict in your JSON

You get a single status and a flat matches array. If any engine flagged it, it shows up.

POST /v1.0/scans MALWARE
{
  "status": "found",
  "filename": "eicar.com",
  "content_length": 68,
  "matches": [
    "Eicar-Test-Signature",
    "EICAR_Test_File",
    "Win.Test.EICAR_HDB-1"
  ]
}
Three engines, three signature names, one consolidated matches array.
Developer experience

Antivirus as a JSON API.
That's it.

No SDK. No signature database. No scanner cluster to run. One REST endpoint for virus and malware scanning — from file uploads and S3 objects to email attachments.

POST /v1.0/scans · scan a file, URL or S3 object
Multiple commercial antivirus engines per request
Synchronous verdict or async via callback URL
Official examples: Node.js, Ruby, Python, Go, PHP, .NET, Elixir, Salesforce Apex
curl -X POST $SCANNER_URL/v1.0/scans \
  -H "Authorization: Bearer $API_TOKEN" \
  -F "file=@user-upload.pdf"
Use cases

File upload virus scanning, wherever files live.

File uploads
Scan every user upload before it hits storage. Reject on found, store on clean.
S3 & Azure blob scanning
Event-trigger scans on new objects. Quarantine infected blobs; tag clean ones.
Email attachments
Inline scan of every inbound attachment. From the team behind CloudMailin — we’ve been scanning email since 2010.
UGC & marketplaces
Keep malware out of avatars, listings and shared files. Protect your users and your reputation.
Global infrastructure

99.9% uptime.
Close to your users.

Multi-region virus and malware scanning across three continents, with real-time status on every region. Need something specific? Dedicated clusters and AWS PrivateLink available for compliance and data residency.

operational
United States
us-east-1
30-day uptime
99.9%+
operational
Europe
eu-west-1
30-day uptime
99.9%+
operational
Asia-Pacific
ap-southeast-2
30-day uptime
99.9%+
View live status page → · Request a dedicated region →
Security

Built for file upload security.

We handle user-uploaded content by default-hostile assumption. Regional data isolation, no persistent file storage, full encryption in transit and at rest.

Regional data isolation
Every scan stays in its region. Each cluster runs its own database — your file data never crosses borders just to be scanned. Maps cleanly onto GDPR and data-residency requirements.
Files deleted after scan
File contents are discarded immediately after scanning. We keep metadata (filename, hash, verdict) for your scan history, and nothing else. Nothing you uploaded lingers on our disk.
Encrypted in transit & at rest
HTTPS / TLS 1.2+ for every request, AES at rest for metadata. Optional AWS PrivateLink keeps scanning traffic off the public internet entirely.
Read the full security overview →
Customers

Teams shipping with AttachmentScanner.

CloudMailin logo
CloudMailin
Email infrastructure
Scans outbound email attachments as they leave the CloudMailin relay, so no virus ever gets forwarded downstream.
Groove logo
Groove
Customer support platform
Keeps malware out of support ticket attachments before they land in agents’ inboxes.
ProFinda logo
ProFinda
Talent & skills platform
Scans document uploads at scale, running multi-region so tenants get low-latency scanning wherever they are.
Pricing

Simple monthly plans.

Every paid plan includes multi-engine scanning, all three regions, and the same REST API. Pick an allowance and upgrade when you grow.

Questions

A few things worth knowing.

01 Why not self-host an open-source scanner? +
A single open-source engine catches a fraction of what a commercial engine stack does. We run multiple commercial antivirus engines in parallel on every request, with signature updates and infrastructure fully managed. You skip the cluster, the patching, and the signature sync — and you get more detections on day one.
02 Do you retain our data? +
No file contents. Uploaded bytes are discarded as soon as the scan completes. We keep metadata — filename, hash, size, verdict, timestamp — for your scan history and audit trail. Each region holds its own database, so data never crosses borders just to get scanned.
03 Can I keep scanning traffic off the public internet? +
Yes. For compliance use cases we offer dedicated scanning clusters in an isolated region, plus AWS PrivateLink so your application reaches us over a private endpoint. Maps cleanly onto SOC 2 and data-residency requirements.
04 How do I handle a positive result? +
You get status: "found" and a list of signature matches. Synchronous flow: reject the upload before it hits storage. Async flow (async: true + callback URL): the file is already stored by the time the verdict lands, so quarantine or delete the object, revoke any access links, and notify affected users.
From the blog

Guides, write-ups, and behind-the-scenes.

All posts →
Guide · AWS
How to scan files in AWS S3 for malware
Presigned URLs, Lambda automation, async scanning. Covers every pattern for scanning S3 buckets in production.
Read
Guide · Security
How to pass a penetration test file upload check
Covers the OWASP file-upload malware test, how to wire scanning in, EICAR integration, and common pen-test findings.
Read
Explainer
What is the EICAR test file?
The safe way to test your antivirus integration. How it works, how to use it, and what the different engines call it.
Read

Ship safer uploads
by lunchtime.

Free 14-day trial. No credit card. Multiple scan engines on every request from day one.