Free Online Suspicious Domain Checker
Analyze a website for key risk factors, domain registration age indicators, and security signals before you click.
- 🛡️Phishing Risk Signals
- 🕒Domain Registration Age Check
- 🔍RDAP Lookup
- ⚠️Punycode / IDN Detection
What Makes a Domain "Suspicious"?
No single factor is definitive, but a combination of red flags is a strong warning sign of potential domain misuse.
Multi-Factor Risk Scoring
A suspicious domain exhibits characteristics commonly associated with short-lived campaigns. Our tool checks domain registration age, Punycode usage, and mail server configurations, while providing an external link for official Google Safe Browsing status. A combination of these factors generates an instant, color-coded heuristic risk score to help you make an informed decision.
Domain Age Anomalies
Newly registered domains can be associated with short-lived phishing or scam campaigns, so domain age is treated as one risk signal. Domains registered for less than 30 days are analyzed carefully.
Punycode & IDN Detection
Detects Punycode-encoded IDN labels (xn--). Punycode is often analyzed to flag potential homograph attacks mimicking popular brands.
Infrastructure Verification
Active domains configure mail servers (MX records) and name servers (NS). The absence of these records can be a weak infrastructure signal, sometimes indicating a temporary or poorly configured site.
Suspicious Domain Checker Tool
How Our Heuristic Risk Score Is Calculated
The score is a heuristic indicator based on selected domain and DNS signals. It is not a malware probability or industry-standard security rating.
| Risk Factor | What It Checks | Weight | Why It Matters |
|---|---|---|---|
| Punycode / IDN | Punycode-encoded IDN labels (xn--). | +20 pts (Review Recommended) | IDN/Punycode detected (xn--). This is not proof of malicious activity; review the domain carefully for lookalike characters. |
| Domain Age < 1 Month | RDAP registration date less than 30 days ago. | +40 pts (Moderate Signal) | Newly registered domains are sometimes used in short-lived scam campaigns. |
| Domain Age < 6 Months | RDAP registration date between 1 and 6 months. | +20 pts (Low Signal) | Relatively new; established domains are less likely to be registered solely for temporary campaigns. |
| No Name Servers (NS) | DNS lookup fails to return NS records. | +15 pts (Low Signal) | The domain may be inactive, misconfigured, or temporarily unavailable. |
| No Mail Servers (MX) | DNS lookup fails to return MX records. | +10 pts (Weak Heuristic) | No MX record is only a weak infrastructure signal and does not indicate that a domain is malicious. |
| Google Safe Browsing | Link to Google Safe Browsing transparent lookup. | External Reference | Check Google's Safe Browsing report for additional threat information from an external verification source. |
Understanding Your Risk Assessment
How to interpret the final color-coded summary card.
High Risk (45+ points)
The domain has multiple risk signals. Avoid visiting the domain until you verify it through a trusted source.
Medium Risk (20-44 points)
Proceed with caution. The domain is either very new or lacks standard configuration. Verify before entering passwords or payment information.
Low Risk (1-19 points)
Minor warning signals. The domain might lack MX records or be relatively young, but no critical phishing indicators were found. Standard browsing caution is advised.
No Automated Red Flags (0 points)
No automated configuration warnings were found. Always verify the Google Safe Browsing link and use standard caution.
Honest by Design — What This Tool Does
This tool evaluates domain heuristics. The tool does not open or execute the submitted website; it only performs domain registration and DNS checks. Here is exactly what it does and doesn't do:
- Checks domain registration age via RDAP and verifies DNS setup.
- Provides an external link to Google Safe Browsing for official malware status.
- Calculates a heuristic risk score based on key registration parameters.
- Does NOT execute JavaScript or visit the actual website (safe analysis).
- Does NOT guarantee a site is safe (heuristics are indicators, not guarantees).
- This tool does not intentionally save scanned domains in its application database.
This tool does
- Analyze domain age via RDAP
- Detect Punycode / IDN domains
- Verify MX and NS DNS records
- Calculate heuristic risk scores
- Provide external link to Google Safe Browsing
- Do not save domains in application database
This tool does not
- Visit or execute site code
- Guarantee safety
- Scan for specific malware payloads
- Check SSL certificate validity
- Store your scan history
- Require an account
How to Use This Checker
Four steps to evaluate key registration and infrastructure signals.
Copy the domain
Copy the domain name (e.g., example.com) of the link. Avoid clicking the link directly.
Paste & Scan
Paste it into the tool above and click Analyze. The server checks RDAP and DNS configurations safely.
Review the score
Check the heuristic assessment. Treat Red or Amber results as warning signals and verify the domain before interacting with it.
Verify with Google
Click the Safe Browsing link in the report for an external, official safety lookup.
Common Phishing & Scam Tactics
How security analysts evaluate indicators and how this tool presents them.
IDN Homograph Attacks
Detects Punycode-encoded IDN labels (xn--) to flag potential homograph attacks mimicking popular brands.
Our check: We detect any Punycode-encoded IDN labels (xn--) in the domain and mark it with +20 heuristic risk points.
Brand New Domains
Newly registered domains can be associated with short-lived phishing or scam campaigns, so domain age is treated as one risk signal.
Our check: We query RDAP registration data. Domains under 30 days old get +40 risk points; under 6 months gets +20.
Typosquatting
Registering g00gle.com or faceb00k.com to target users who make typographical errors.
Analysis: Requires visual validation. Always verify the spelling carefully before entering credentials.
Missing Infrastructure
Active domains often set up mail servers (MX) and name servers (NS) as part of their service configurations.
Our check: We check DNS records. Missing MX adds +10 points (weak heuristic); missing NS adds +15 points.
Subdomain Misdirection
Attackers use subdomains like login.bank.com.scam-site.com. Users only notice the first part of the URL.
Analysis: The tool analyzes the submitted hostname as provided. Check the actual registrable domain carefully; the registrable domain, not the first subdomain label, usually identifies the registered domain owner.
Newly Registered Domains
Recent campaigns can bypass list-based checkers before they are categorized.
Our check: This is why we check registration age and DNS records. A very young domain with minimal configuration triggers warnings here early.
When to Run a Domain Check
Analyze domains when encountering these common communication vectors.
Domain Security FAQs
Answers regarding registration signals, configuration, and domain evaluation.
What is Punycode and how is it used?
Punycode represents Unicode strings within the limited character set of DNS. Browsers may display an IDN using Unicode or its Punycode representation depending on the domain and browser security rules. This tool evaluates Punycode status to highlight potential homograph similarities.
What should I do if a domain has high risk signals?
Avoid visiting the domain until you verify it through a trusted source. Treat it as a warning signal and avoid sharing passwords, credit card info, or personal identifiers.
Does this tool visit the suspicious website?
No. The tool does not open or execute the submitted website. It only performs domain registration (RDAP) and DNS checks against configuration data safely on our servers.
Why is domain registration age analyzed?
Attackers may register newly created domains for short-lived phishing or scam campaigns. While new businesses also register domains, treating age as one heuristic signal helps flag temporary domains.
What if the domain is new but legitimate?
It's possible! New sites launch daily. If a young domain registers warning points, verify the identity of the domain and context before concluding it is unsafe.
Does 'No Automated Red Flags' mean safe?
No security tool can guarantee safety. 'No Automated Red Flags' means no simple configuration issues were detected. Always use caution, updated browsers, and reliable endpoint protection.
What's the difference between this and a Malware Checker?
Google Safe Browsing checks URLs against Google's lists of known unsafe web resources, including phishing and malware-related threats. Our tool evaluates infrastructure heuristics (DNS/MX/RDAP) to flag patterns.
Is this tool free?
Free to use. No signup required. Rate limits (30 scans/hour per IP) are active to manage server load and prevent abuse.