Website reputation check

Blocklists, signs of phishing and malicious URLs: whether browsers, mail services and security filters trust your domain, and what to do if they do not.

• All services

A site can be fast, well designed and correctly configured — and still lose visitors because someone else has decided it is dangerous. Browsers put a red warning page in front of it, mail services move its emails to spam, corporate firewalls block it, and the owner learns about it from a customer complaint. A reputation check shows how your domain and your server look to these filters, before they start costing you traffic and sales.

Blocklists

The domain and the IP address the site is served from are checked against the public lists that mail services, firewalls and antivirus products use:

• IP lists — Spamhaus ZEN, SpamCop and UCEPROTECT. They list addresses that send spam, belong to botnets or have been compromised. On shared hosting your site can end up there because of a neighbour on the same server;
• domain lists — Spamhaus DBL, SURBL and URIBL. They list names seen in phishing, malware and spam campaigns, including legitimate sites that have been hacked and used to host somebody else's pages;
• Google Safe Browsing — the list that decides whether Chrome, Firefox and Safari show the "Deceptive site ahead" warning instead of your page.

For every listing the report explains what exactly it means — a dynamic address range is one thing, a domain marked as phishing is quite another — and where to request removal. A list that refused to answer is shown as not checked rather than as clean, so a "no problems" result is a measured result and not a guess.

Signs of phishing and compromise

Hacked sites are often used for phishing without the owner noticing: the attacker puts a fake bank login page deep in some folder and sends links to it, and the first sign the owner sees is the warning in the browser. The lists above say why a name was listed, and the report keeps that reason instead of a bare "listed": phishing, malware, compromised site, spam domain. Safe Browsing answers in the same terms — social engineering (that is, phishing), malware, unwanted software — for both the HTTP and the HTTPS address of the site.

The domain itself is checked too, because filters look at it before they look at the content. A name registered only days ago, a registry status like clientHold or pendingDelete that takes it out of DNS, a missing abuse contact at the registrar — each of these makes a filter more suspicious. None of them is proof by itself, so the report shows them as context next to the listings rather than as accusations.

Malicious URLs

Being on a domain list means that the addresses of your site are treated as malicious URLs: mail filters cut links to them out of emails, messengers stop showing previews, search engines can drop the pages. Because the lists work on the registered name, one hacked folder affects every page of the domain, and a listing of the server's IP affects every site hosted on it. The report shows which of these happened, so it is clear whether to clean the site or to talk to the hosting provider.

Mail and spoofing

Reputation is also about who can send mail on your behalf. If SPF and DMARC are missing or set to "do nothing", anyone can send a phishing email from your address, and the complaints will hit your domain. The check reads the SPF, DMARC, MTA-STS and BIMI records, explains what each one allows and suggests a safe path to an enforcing DMARC policy.

What to do with the result

If everything is clean, the report says so and shows when the check was done. If something is found, you get a step-by-step plan: what to clean up on the site, which password and access keys to change, where to submit the delisting request and how to ask Google for a Safe Browsing review. Removal is usually quick once the cause is fixed — the hard part is noticing in time.

Monitoring

A listing can appear on any day, and the sooner it is noticed, the less damage it does. Add the site to monitoring and the reputation check is repeated automatically; if the domain or the server appears in a blocklist, a notification arrives by email or Telegram. For agencies and hosting providers the same check is available through the API for any number of sites.