A lookalike domain in an email, an ad or a chat message can cost you a password in one click. The Kwebby Suspicious Domain Checker is a suspicious domain checker that runs three quick tests on any domain: a Google Safe Browsing lookup, a DNS blacklist lookup of the domain's IP address and a DNS resolution check. It scores the domain out of 3 and explains each result in one line. This guide shows what each test means, how to read the score and where the tool stops, so you know when to dig deeper.
Key Takeaways
- The Kwebby Suspicious Domain Checker runs three tests on a domain: Google Safe Browsing, a DNS blacklist lookup of the domain's IPv4 address and a DNS resolution check.
- Each passed test adds one point. With no flags the label reads "No warning signs in these checks". One flag reads "One warning sign found" and two or more read "Several warning signs found". A test that cannot run shows UNKNOWN and earns no point.
- You type a domain such as suspicious-site.com into one field and click Scan. The tool is free and needs no account.
- A clean score lowers risk but does not prove safety, because brand-new scam domains often sit on no list yet.
- The scan does not show registration age, so pair it with the Domain Age Checker when a domain looks new.
- Run the check before you click, before you link out to an unfamiliar site and before you accept files from it.
What Is the Kwebby Suspicious Domain Checker?
The Kwebby Suspicious Domain Checker is a free web tool that tests a domain against Google Safe Browsing, spam blacklists and DNS, then returns a score out of 3. Use it to decide whether an unfamiliar domain deserves your click, your link or your trust. It checks whole domains, so enter a domain name, not a page address.
The tool is part of Kwebby's SEO tools. It combines signals you could otherwise collect one at a time from the Google Malware Checker and the Blacklist Lookup into a single scan.
Key Features and How It Works
Google Safe Browsing check
The first result row, "Google Safe Browsing", sends the domain's home page address to the Google Safe Browsing Lookup API. Safe Browsing warns people about malware, unwanted software and social engineering such as phishing. Google lists Chrome, Search, Gmail, Android and Google Ads among the products that use it. A pass reads "Not on Google Safe Browsing lists". A flag names the threat type, such as malware or social engineering.
DNS blacklist check
The second row, "DNS Blacklists (domain IP)", looks up the domain's first IPv4 address and checks that IP against the 9 DNS blacklists used by the Blacklist Lookup, including Spamhaus, Barracuda and SpamCop. A pass shows how many lists answered. A flag names the lists that list the IP. An IP listing points to spam or abuse from that server, and on shared hosting the listing can come from another site on the same IP. The tool does not query domain-based lists such as SURBL or URIBL.
DNS resolution check
The third row, "DNS Resolution", asks Google Public DNS for the domain's A (IPv4) record. A pass reads "Domain resolves to an IPv4 address". A flag reads "Domain does not exist (NXDOMAIN)" or "No IPv4 (A) record found". A domain that does not resolve has no working site behind it, which can mean a typo, an expired registration or an abandoned scam page. A domain that only has IPv6 records also gets this flag.
The score out of 3
The tool adds one point for every passed test and shows the total in large type. With no flags, the label reads "No warning signs in these checks". One flag reads "One warning sign found", and two or three flags read "Several warning signs found". If a test cannot run, it shows UNKNOWN, earns no point and the label says how many checks could not run. Read the three rows under the score to see which test failed, because the same number can come from different problems.
Why Checking a Domain Matters
Checking a domain takes seconds and can prevent credential theft, malware infections and links to harmful sites. Attackers register domains for short campaigns, so the domain name is often the first clue you get.
Age is part of that picture. In a 2019 study, Palo Alto Networks Unit 42 classified more than 70 percent of domains registered in the previous 32 days as malicious, suspicious or not safe for work, against 7.6 percent for the Alexa top 10,000. The category includes adult content, so do not read 70 percent as pure malware. The lesson holds anyway: new domains deserve more scrutiny than old ones.
Site owners have a second reason. Every outbound link sends your readers somewhere, so scan link-building prospects and partner sites before you link to them.
How to Use the Suspicious Domain Checker
- Open the tool and find the input field with the example "e.g. suspicious-site.com".
- Type or paste the domain name. If you paste a full link, the scan uses the domain part.
- Click Scan, or press Enter. The button changes to "Scanning..." and the message "Running security checks..." appears.
- Read the score and the label under it.
- Read the three rows (Google Safe Browsing, DNS Blacklists and DNS Resolution) to see which test raised a flag.
- Decide your next step using the best practices below.
Best Practices for Checking Suspicious Domains
Treat a clean score as one signal
A 3/3 means none of the three tests raised a flag at the moment of the scan. New scam domains can sit on no list for days. Use the score to rule things out, never to give a clearance.
Read the domain name yourself
Lookalike names give scams away. Malwarebytes' guide to checking links lists tricks such as swapping "rn" for "m", using a numeral in place of a letter and adding extra words to a familiar brand. The same guide points out that a phishing link with HTTPS is still a scam link. The SSL Checker can confirm whether a certificate is valid, but a valid certificate says nothing about the owner's intent.
Check the domain age separately
This scan does not report registration age. Use the Domain Age Checker for one domain or the Bulk Domain Age Checker for a list. A domain registered last week that asks for a login deserves a firm no.
Avoid common mistakes
- Do not treat a DNS Resolution flag as proof of fraud. A typo or an expired domain fails the same way.
- Do not ignore a blacklist listing because Safe Browsing is clean. The two lists catch different things.
- Do not scan once and forget. Re-run the check before you add a link or send outreach, because lists change.
Common Use Cases
- Email and ad links. Scan the domain before you click a link that asks you to log in or pay.
- Link building. Check a guest-post or partner prospect before you link to it.
- Downloads and invoices. Check the sending domain before you open an attachment.
- Domain purchases. Combine this scan with the age and WHOIS results before you buy a used domain.
- Your own site. If a visitor reports a warning, run the Google Malware Checker to see the threat type.
Related Kwebby Tools
The Google Malware Checker runs only the Safe Browsing test and lists the threat types it finds, which helps when you need detail on one URL. The Blacklist Lookup checks an IP, or the IP a domain points to, against the same DNS blacklists and shows the listing code for each list. The Domain Age Checker shows how old a domain is, and the WHOIS Checker returns the full WHOIS record for any domain. To see the records behind a hostname, open Find DNS Records.
Frequently Asked Questions (FAQs)
What makes a domain suspicious?
A domain is suspicious when it shows warning signs such as a Google Safe Browsing flag, a spam blacklist listing, a very recent registration, an unusual top-level domain or a DNS failure. Kwebby's checker tests the Safe Browsing flag, the DNS blacklist status of the domain's IP and DNS resolution directly. Check registration age separately.
How can I tell if a domain is fake or malicious?
Scan it, then read the name for lookalike tricks, check how old the domain is and avoid entering passwords or payment details on any domain you cannot verify. A padlock icon is not proof of honesty, because phishing sites can use HTTPS too. When in doubt, type the brand's address yourself instead of following the link.
Is a domain safe if it scores 3/3?
No score proves safety. A 3/3 means the domain passed all three tests at the moment of the scan, but a new scam domain can appear on no list for days. Add an age check and judge the sender and the request.
Does the Suspicious Domain Checker show domain age?
No. The scan returns three results: Google Safe Browsing, DNS Blacklists and DNS Resolution. For creation and expiry dates, use the Domain Age Checker, or the Bulk Domain Age Checker for a list.
Is the Suspicious Domain Checker free?
Yes. The tool is free and needs no account.
Final Thoughts
The Suspicious Domain Checker gives you three fast signals and one clear score, which is enough to catch obvious problems before they reach you. Read all three rows instead of the number alone, and add an age check whenever a domain looks new. Try it on the next unfamiliar link in your inbox. If the domain belongs to your own site and it fails, move on to the Google Malware Checker for threat details.