Domain Reputation Check
Malware & Phishing Blacklists + IP Intelligence.
Check any domain against 1M+ flagged domains from live malware and phishing threat feeds, resolve its DNS records, and analyze the IP addresses behind it — all in one lookup.
How the Domain Reputation Check Works
One lookup runs the domain through three layers: threat-intelligence blacklists, disposable email detection, and IP-level analysis of the infrastructure behind it.
Threat Blacklist Check
The domain is matched against more than a million flagged domains aggregated from live threat feeds — URLhaus, OpenPhish, Phishing Army, ViriBack, and the maltrail project. Each match comes with its category: malware distribution or phishing. Feeds are re-downloaded continuously, so new campaigns show up within hours.
Disposable Email Detection
The same lookup tells you whether the domain is a known disposable or temporary email provider. Signups from throwaway domains are a classic abuse pattern — catching them at the domain level blocks the whole provider, not just one address.
DNS Resolution + IP Intelligence
We resolve the domain's live A and AAAA records and run full IP intelligence on each address: geolocation, ISP and ASN, plus VPN, proxy, Tor, datacenter, and IP-level threat flags. A domain that no longer resolves is reported too — a common state for taken-down malicious sites.
API Documentation & Code Examples
One endpoint returns the threat verdict with categories, disposable email detection, resolved DNS records, and full IP intelligence for every address. Wire it into signup screening or link scanning in minutes.
GET /api/v1/domain/reputation/{domain}?api_key={key}
# Domain reputation lookup
curl "https://ip-api.io/api/v1/domain/reputation/example.com?api_key=YOUR_API_KEY"
{
"domain": "example.com",
"is_valid": true,
"threat": {
"is_threat": true,
"categories": ["malware", "phishing"]
},
"is_disposable_email_domain": false,
"resolved_ips": [
{
"address": "104.21.71.71",
"type": "A",
"ttl": 300,
"ip_info": { "isp": "CLOUDFLARENET", "asn": "AS13335", … }
}
]
}
GET /api/v1/domain/reputation/{domain}?api_key={key}
async function checkDomainReputation(domain) {
const res = await fetch(
`https://ip-api.io/api/v1/domain/reputation/${domain}?api_key=YOUR_API_KEY`
);
const data = await res.json();
console.log(data.threat.is_threat); // true
console.log(data.threat.categories); // ["malware", "phishing"]
return data;
}
{
"domain": "example.com",
"is_valid": true,
"threat": {
"is_threat": true,
"categories": ["malware", "phishing"]
},
"is_disposable_email_domain": false,
"resolved_ips": [
{
"address": "104.21.71.71",
"type": "A",
"ttl": 300,
"ip_info": { "isp": "CLOUDFLARENET", "asn": "AS13335", … }
}
]
}
GET /api/v1/domain/reputation/{domain}?api_key={key}
import requests
res = requests.get(
"https://ip-api.io/api/v1/domain/reputation/example.com",
params={"api_key": "YOUR_API_KEY"}
)
data = res.json()
print(data["threat"]["is_threat"]) # True
print(data["threat"]["categories"]) # ["malware", "phishing"]
{
"domain": "example.com",
"is_valid": true,
"threat": {
"is_threat": true,
"categories": ["malware", "phishing"]
},
"is_disposable_email_domain": false,
"resolved_ips": [
{
"address": "104.21.71.71",
"type": "A",
"ttl": 300,
"ip_info": { "isp": "CLOUDFLARENET", "asn": "AS13335", … }
}
]
}
Why Check Domain Reputation
Signup & Transaction Screening
Check the email domain of every new registration against threat and disposable lists before the account is created. A signup from a phishing-flagged or throwaway domain deserves a challenge or a block — one API call gives you both verdicts plus the hosting infrastructure.
Link & Content Scanning
Scan domains from user-submitted URLs, chat messages, or referral traffic before your users click them. The malware and phishing categories tell you exactly why a domain is dangerous, so you can warn, sandbox, or block accordingly.
Security Operations & Triage
Enrich alerts and logs with domain verdicts and the IP intelligence behind them. Knowing a suspicious domain resolves to a datacenter IP that is itself threat-flagged turns a vague alert into an actionable one — without pivoting through three separate tools.
Domain Reputation — FAQs
Common questions about domain reputation and the ip-api.io Domain Reputation API.
What is domain reputation?
Domain reputation is a measure of how trustworthy a domain name is, based on whether it appears on threat intelligence blacklists, hosts malware or phishing content, serves as a disposable email provider, and what infrastructure its IP addresses run on. A domain flagged on malware or phishing feeds has a bad reputation and should be treated as dangerous.
How do you check domain reputation?
You can check domain reputation with the free tool at the top of this page — enter any domain and get an instant verdict. The check compares the domain against more than a million flagged domains aggregated from threat feeds including URLhaus, OpenPhish, Phishing Army, and ViriBack, then resolves the domain's DNS records and analyzes each IP address. For programmatic use, the ip-api.io Domain Reputation API at GET https://ip-api.io/api/v1/domain/reputation/{domain} returns the full report as JSON.
Is this a domain blacklist check?
Yes — the tool performs a domain blacklist check against continuously updated malware and phishing blocklists. Note that it checks web threat blacklists, not email deliverability blacklists (DNSBL/RBL): it tells you whether a domain distributes malware or hosts phishing, not whether its mail server is blocked for spam.
What threat categories are detected?
Flagged domains are categorized as malware (malware distribution, botnet command-and-control panels) or phishing (credential harvesting and fake login pages). The check also flags disposable email domains, and the IP intelligence layer adds VPN, proxy, Tor, datacenter, and IP-level threat signals for every address the domain resolves to.
Why check the domain's IP address too?
A domain is only as trustworthy as the infrastructure behind it. Resolving the domain's A and AAAA records and analyzing each IP reveals where the site is actually hosted, which network operates it, and whether that IP is itself flagged — signals that catch fresh malicious domains before they appear on any domain blacklist.
Is the domain reputation checker free?
Yes, the interactive domain reputation checker on this page is completely free with no sign-up required. API access for automated checks requires a paid subscription — see the pricing section for plans.
Simple, transparent pricing
Start small, scale as you grow. No hidden fees.
Check any domain's reputation in one call
Malware and phishing blacklists, disposable email detection, DNS resolution, and full IP intelligence — one endpoint for signup screening, link scanning, and alert enrichment.