Where reputation scores come from, what they include (and exclude), how blacklist listings and phishing flags compound risk, and how to evaluate a destination with the same rigour a fraud team applies.
Treat the number as a starting point, not a conclusion. Check what drove it: is the listing based on an old incident on a previous owner's infrastructure? Is the score depressed simply because the domain is new? Investigation always beats a single integer.
Run through these steps in order. Each step links to the right diagnostic tool.
Vendors aggregate spam telemetry, malware reports, abuse complaints, hosting reputation, content classification, age, and traffic patterns into a single number. Each vendor weights differently.
No. New scam sites often score neutral simply because no one has reported them yet. Combine with TLS, age, and content signals.
It's evidence — not a verdict. False positives happen, especially on shared hosting. A consensus across 3+ independent feeds is meaningful.
User reports, browser telemetry (Safe Browsing, SmartScreen), kit fingerprint matching, and brand-impersonation detection all feed phishing feeds.
Fix the underlying signals — clean up abuse, enable SPF/DKIM/DMARC, request delisting after remediation, and maintain consistent infrastructure hygiene.
Monitor it continuously
Save this check, get alerts on changes, and track multiple domains in one dashboard.