It's a hashed representation (in SHA256) of the resource in question, potentially malicious. They check and track other domains/URL where the same resource was seen or reported, as an indicators of compromise (IoC).
If they detect the same resource in your target URL/server, they will report it (i.e. the presence of well-known malware file represented by a SHA-256 hash, which in theory should not change since it's a trapdoor-permutation)
VirusTotal does something similar, also add the fact that urlscan.io service utilizes Google's Safe Browsing API:
The Safe Browsing lists consist of variable length SHA256 hashes (see
List Contents). To check a URL against a Safe Browsing list (either
locally or on the server), clients must first compute the hash prefix
of that URL.
When using the Lookup API to check URLs, the client sends the actual
URL in the request and Safe Browsing server converts the URL to a hash
before performing the check (see Checking URLs for the Lookup API).