URL & Website Reputation Check

Enter the site's address and run the scan. A website reputation check runs the same scan as a URL check, but against the site's root address: the host is checked against the threat-intelligence blocklists that email providers and security filters use, and its web server IP is checked too. Type a bare domain and it is treated as an https:// address automatically. For the trust signals mailbox providers assign to a sending domain, use the domain reputation check instead.

Two layers always run. First, the structure of the URL itself, for four specific warning signs: a raw IP address instead of a host name, a punycode (xn--) host that can disguise look-alike characters, credentials embedded before an @ sign, and a missing HTTPS scheme. Second, the host against domain threat blocklists, plus the site's web server IP against IP blocklists. A third layer, the URLhaus malware database run by abuse.ch, runs only where an abuse.ch key is configured and otherwise reports itself as not checked.

It means no blocklist flagged the address, but the URL itself carries at least one structural warning sign, for example a punycode host or embedded credentials. That combination is worth a careful look: brand-new phishing pages are routinely not listed anywhere yet, because listing lags the attack. Suspicious is a prompt to inspect, not a confirmed malicious verdict.

No, and this is the most important limit to understand. Blocklists are historical: a URL created an hour ago for a targeted phishing campaign has no history and will come back clean. A clean result means nothing known is recorded against the address, not that the destination is trustworthy. Judge an unexpected link on where it came from and what it asks you to do, not only on a reputation scan.

The URLhaus lookup needs an abuse.ch authentication key, and no key is configured on this site today, so that card reports itself as not checked rather than claiming a clean result. Treat it as unknown. The structural and blocklist layers still run, and the verdict above is built from those.

No, and deliberately not. Several tools return a single number, which hides how it was reached. This returns a verdict plus the evidence behind it: which sources answered, which recorded something, and which structural warning signs the URL itself carries. A number cannot tell you that two of three blocklists never replied, and that distinction changes what the result is worth.

They answer different questions. URL reputation asks whether a specific web address is associated with malware or phishing, which is a security question about a link. Domain reputation asks how mailbox providers treat mail sent from a domain, which is a deliverability question about a sender. A domain can be perfectly clean for security and still have poor sending reputation, and the reverse.

Use the phishing link checker. It runs comparable checks but answers the recipient's question directly, in plain language: is this safe to click, and what should I do if I already did. This page is aimed at the other job: checking a site you own, link to, or are investigating.

Because a link is the usual payload. A message can pass every authentication check and still carry a URL that leads to a credential-harvesting page, so providers score the links independently of the sender. That is why a compromised site can quietly damage the deliverability of anyone who links to it.

Re-scan to confirm which sources still list it, then follow each listing operator's own removal process. Delisting is theirs to grant, not something a scan can do. Fix the underlying cause first, since a delisting on a site that is still compromised is temporary.