Check the reputation of any domain in real time. Get a safe, suspicious, or malicious verdict, a 0 to 100 trust score, and the signals behind it. Free for single checks, no signup.
For request and response examples, trust score methodology, DGA analysis, threat intelligence fields see the Domain Reputation API documentation.
Domain Reputation Check FAQs
Common questions about domain reputation, trust scores, and how this tool works.
What is a domain reputation check?
A domain reputation check evaluates whether a domain is safe to trust. It looks at the domain's threat history, registration age, DNS and email authentication, SSL certificate, hosting behavior, and name patterns, then returns a verdict of safe, suspicious, or malicious along with a trust score and the signals behind it.
Is the domain reputation check free?
Yes. The WhoisFreaks Domain Reputation Check tool is free for single, one-at-a-time checks with no signup. For bulk checks or programmatic access, the Domain Reputation API is available on paid plans. See the Pricing page for details.
How is the trust score calculated?
The score starts at 50 and moves up or down based on signals such as SPF and DMARC records, domain age, SSL certificate quality, WHOIS privacy, redirect behavior, and threat matches. The final value lands between 0 and 100 and maps to a low, medium, or high trust band.
What does a suspicious or malicious verdict mean?
A malicious verdict means the domain matched a known threat indicator, such as a phishing or malware record, and the recommended action is to block it. A suspicious verdict means the domain is linked to known threats or shows concerning signals, and the recommended action is to monitor or investigate it.
Why is a domain flagged even if it is not on a blocklist?
The tool does more than blocklist matching. It flags domains that share registration or hosting attributes with known threats, and it scores signals like a recent registration date, missing email authentication, a free certificate, or an algorithmically generated name. A domain can look risky on these signals before any blocklist adds it.
How current is the reputation data?
Each check runs in real time. DNS, WHOIS, SSL, and content are queried live at the moment of your request, and the threat intelligence match uses continuously updated data. The DGA analysis runs on the domain name itself, so it needs no external lookup.
Can I check domains in bulk or through an API?
Yes. For checking many domains or for checks inside your own systems, use the Domain Reputation API, which returns the same verdict, trust score, and evidence as this tool in a single call.
What is DGA detection?
DGA detection identifies domains created by a domain generation algorithm, a method malware uses to generate large numbers of random-looking domains. The tool scores each domain name using entropy, letter patterns, digit ratio, and TLD, then labels it as human-readable, indeterminate, or likely generated.
