Skip to main content
Threat Intelligence

Domain Reputation Score, categories and evidence for any domain.

Try it now
Examples

Enter a domain to review its reputation, registration and infrastructure.

Output

How this check works · illustration

A 0–100 risk score, phishing and malware categories, WHOIS and DNS history, with the sources behind each verdict.

Check Domain FreeAPI Documentation
curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant

50 free requests/month · instant API key · no signup form

Fictional example

Read an example domain report.

Illustration dated 2026-09-01. Indicators, providers, scores and observations are fictional. This is not a current result for these addresses.

Example requestGET /api/check?query=example.com

example.com

DomainHigh risk

Registration

Registered2026-08-20
Updated2026-08-21
Expires2027-08-20
RegistrarExample registrar
Age12 days

Email DNS records

SPFPresent
DMARCNot observed
DKIMNot checked

A missing DMARC record is an email configuration observation. It does not by itself establish malicious activity.

Sources flagging

3of 4 sources

Confidence

80 %

The score and confidence are illustrative values. Confidence describes support for the assessment; it is not a percentage of sources or a probability of compromise.

Example categories

PhishingMalware

Example source observations

Example source observations
SourceObservation
Example feed AFlagged
Example feed BFlagged
Example feed CFlagged
Example feed DNot listed

“Not listed” means this source has no listing in the example. It is not a clean bill of health.

How to interpret it

Compare source observations, dates and technical context before taking action. This example makes no attribution to a threat actor.

Fictional example3 sources flag the indicatorConfidence: 80 %No live lookup

Real reports depend on the indicator, available sources and access level. Missing data is shown explicitly. These panels illustrate how to read the data; they are not an API response schema.

Domains
20M+
Sources in the corpus
591
Risk score
0–100
WHOIS cache
24 h
Domains per bulk call (Pro)
100
Capabilities

Signals for your investigation, with their context.

Multi-source evidence

Commercial, open-source and research feeds, with each match attributed to its source.

Risk score

A 0–100 score with the indicators and confidence behind it.

Threat categories

Malware, phishing, spam, C2, cryptomining and more.

WHOIS context

Registrar, registration date and domain age, never more than 24 hours old.

Reputation history

How the domain’s risk has changed over time.

Bulk lookups

Check a batch of domains in one request: 10 per request on Free, 100 on Pro, 500 on Enterprise.

Applications

Use cases to evaluate first.

  1. Email gateways

    Check sender domains and links before delivery.

  2. Web proxy filtering

    Block malicious sites at the proxy.

  3. SIEM enrichment

    Add domain reputation to alerts for faster triage.

  4. Fraud prevention

    Screen domains at sign-up and checkout.

FAQ

Frequently asked questions.

How often is domain reputation data updated?

Each source is ingested on its own schedule. A lookup returns the latest data stored for the domain, with first-seen and last-seen dates.

What sources do you use for domain reputation?

Commercial threat feeds, open-source blocklists and research datasets. Each verdict names the sources that matched.

Can I check newly registered domains?

Yes. A domain under 30 days old is scored as very new, under 90 days as new, and every response includes its age.

What's the rate limit for the free tier?

Free accounts can make up to 50 API requests per month, in batches of up to 10 indicators, and monitor 5 entities. Pro raises that to 10,000 reputation checks a month and adds larger batches, more monitored entities and webhooks.

New to the term? Read the glossary definition.

Explore

Related tools and pages.

IP Reputation

Check IP address risk scores

URL Scanner

Scan full URLs for threats

WHOIS Lookup

Domain registration data

Is this website legit? How to spot a fake shop or lookalike domain

Read the address, check the domain and the business behind it, and pay only in a way you can dispute.

Fake invoice or changed bank details: what to do before you pay

Call the supplier on a number you already had before paying any new bank details.
Research

Related articles from the research blog.

Blog post

Domain Reputation Monitoring: Which Changes Need Action?

Track domain reputation over time: distinguish a new phishing report from expected DNS changes, then decide what to verify before restricting access.

Read more

Blog post

WHOIS Lookup for Security Investigations: Reading a Record After Redaction

Privacy services stripped the registrant name out of most WHOIS records, but the fields that matter for triage survived. Here is what a WHOIS record still tells an analyst, and how to read it.

Read more

Blog post

Domain Lookup: How to Identify Malicious Websites Before They Strike

Malicious websites are the launchpad for phishing, malware distribution, and credential theft. Learn how domain lookup tools use reputation data, WHOIS analysis, and threat feeds to identify dangerous domains before your users click.

Read more

Test it with your own indicators.

The free plan includes 50 lookups a month. Check the sources and limits, then connect the API.

Create free accountContact Sales

No credit card required · Free API key