Security teams triage reported phishing emails all day. Trust and safety teams review links posted by users. Brand protection teams look for sites impersonating their login page. Each of them needs to know what's behind a URL, and opening it in your own browser exposes your machine, your IP address and possibly your session. Render it somewhere else and look at the picture.
Capture a suspicious link
curl -X POST "https://shotkit.net/api/take" \
-H "X-Access-Key: YOUR_ACCESS_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"https://suspicious.example.net/login","response_type":"json","format":"png","ignore_host_errors":true,"metadata_page_title":true,"metadata_http_response_status_code":true,"metadata_http_response_headers":true,"metadata_content":true,"metadata_content_format":"html"}' \
--fail-with-body -o shot.jsonignore_host_errorscaptures the page even when it returns a 4xx or 5xx; for phishing kits, error pages are evidence too.metadata_contentstores the rendered HTML, so you can look for form targets and kit fingerprints without visiting.- The response headers and status record how the server answered.
Why it's safer
- The page loads in a fresh, isolated browser context on shotkit's servers, never on an analyst's laptop.
- The site sees shotkit's IP address, or your
proxy, not your company's network. - Each request starts with no cookies or storage, so nothing from your accounts is exposed.
See what the target sees
Phishing kits often cloak: they show the fake login only to visitors from the targeted country or on mobile, and a harmless page to everyone else. Match the target:
curl -X POST "https://shotkit.net/api/take" \
-H "X-Access-Key: YOUR_ACCESS_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"https://suspicious.example.net/login","viewport_device":"iphone_15_pro","headers":["Accept-Language: en-GB"],"time_zone":"Europe/London","ignore_host_errors":true,"format":"png"}' \
--fail-with-body -o shot.pngAdd a proxy in the targeted country when the kit checks IP addresses.
Triage with a vision model
Ask a model whether the page imitates a brand's login. With your OpenAI key, the answer comes back with the screenshot:
curl -X POST "https://shotkit.net/api/take" \
-H "X-Access-Key: YOUR_ACCESS_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"https://suspicious.example.net/login","ignore_host_errors":true,"response_type":"json","openai_api_key":"sk-YOUR_OPENAI_KEY","vision_prompt":"Does this page imitate the login page of a known brand? Reply as JSON: {\"impersonates\": brand name or null, \"asks_for_credentials\": true or false}","vision_max_tokens":60}' \
--fail-with-body -o shot.jsonUse it to sort the queue, and keep a person on the final call.
Frequently asked questions
Is this a malware sandbox?
No. It renders the page and captures what it shows; it doesn't execute downloads or analyze malware behavior. Use a dedicated sandbox for files and payloads.
Can the site tell it's being screenshotted?
It sees a normal Chrome visit from a data center address. Sophisticated kits may treat data center visitors differently; a residential proxy and a matching device make the visit look more like a real target.
How long are captures kept?
Files on the CDN expire after cache_ttl, 4 hours by default. Download screenshots and HTML you need for a case, and store them with your incident records.