Domain Reputation Tools Compared: What Each One Actually Checks
Talos, Spamhaus, VirusTotal, Safe Browsing, FortiGuard, SpamZilla and more — which question each tool answers, what its verdicts mean, and the order to run them in before you buy a website.
Type a domain into five reputation checkers and you will get five different answers. One says "Neutral", one says "0/30 detections", one says "No unsafe content found", one shows a category you didn't expect. Buyers tend to read that as noise, pick the friendliest result, and move on.
That is the mistake. Each of these tools measures something different, from different data, over a different time window. Most of them only tell you about today. A domain you are about to buy needs to be judged on its history. This guide sorts the tools by the question they actually answer, explains how to read each verdict, and gives you a running order that takes about 30 minutes.
Why this matters
Reputation problems are one of the few defects in a website that you cannot fix with money after the sale. You can rewrite thin content, you can migrate a slow host, you can rebuild a broken monetisation stack. You cannot quickly undo a domain's listing on a spam blocklist, a malware history in security vendors' databases, or a content category that gets the site blocked on corporate and school networks.
The practical costs are specific:
- Search visibility. A domain with a spam past may be carrying signals that suppress rankings. See how to check a domain's spam history for the deeper investigation.
- Audience reach. Security vendors' categories feed firewalls and web filters. A bad category silently removes readers.
- Email. A domain on a major blocklist will struggle to deliver a newsletter, password resets or affiliate follow-ups.
- Negotiating position. Discover the problem before the letter of intent and it is a price conversation or a walk-away. Discover it after the transfer and it is your problem.
The tools below exist for security teams and email administrators, not website buyers. That is why their output is confusing out of context. Used in the right order, they are free, fast, and far more reliable than a seller's assurance that "the domain is clean".
Step 1: Know the three questions before you open a tool
Every reputation tool answers one of three questions. Mixing them up is how buyers get false comfort.
- Is this domain dangerous right now? Security verdicts: malware, phishing, active spam. Answered by Google Safe Browsing, VirusTotal, URLVoid and Cisco Talos.
- Is this domain on a blocklist? Email and DNS-based lists used by mail servers. Answered by Spamhaus and MXToolbox.
- What has this domain been used for over time? Content categories and historical use. Answered by FortiGuard, Symantec Site Review, the Wayback Machine and SpamZilla.
Questions 1 and 2 describe the present. A seller who cleaned up a spam domain eighteen months ago can pass both with a perfect score. Only question 3 catches a laundered domain, and it is the one most free "domain reputation checker" pages don't touch.
Run all three groups. A domain is only clean when all three agree.
Step 2: Current security verdicts
Google Safe Browsing
Go to the Safe Browsing site status page in Google's Transparency Report and enter the domain.
- "No unsafe content found" with a recent scan date is the result you want.
- Any other result names a threat type, such as malware or deceptive (phishing) content.
Two things to understand. First, this tool shows the current state and the date of the most recent check, not a history. Second, it matters more than almost any other result here, because Safe Browsing powers the red warning screens in Chrome and other browsers. Google says unsafe sites are added to its list within minutes of detection. A current flag is a hard stop until the seller has had it cleared and can explain how it happened.
VirusTotal
Paste the domain into VirusTotal. It queries over 70 antivirus scanners and URL/domain blocklisting services and shows each vendor's individual label, such as malicious, phishing, suspicious or clean.
How to read it:
- 0 detections is normal for a healthy site.
- One detection from a single minor vendor, with every major vendor clean, is weak evidence. Note the vendor and the label, then look for corroboration in the other tools.
- Several vendors agreeing on "malicious" or "phishing" is a real finding.
Open the Community tab too. Security researchers and site owners leave comments there, and a thread of past abuse reports tells you more than the headline number.
URLVoid
URLVoid checks a domain against 30+ blocklist engines and reputation services, and adds the domain's creation date, IP address and server location in the same report. It overlaps with VirusTotal, which is the point. Use it as a second opinion. If the creation date it shows disagrees with what the seller claimed, go back to verifying the real domain age before anything else.
Cisco Talos
Search the domain in the Talos Reputation Center. Talos returns a web reputation, an email reputation and a content category.
The web reputation uses six levels, and the vocabulary trips people up:
| Talos web reputation | What it means for a buyer |
|---|---|
| Trusted / Favorable | Positive evidence over time. Rare for small sites |
| Neutral | Evaluated, nothing bad found. This is the normal result for most legitimate sites |
| Unknown | Not evaluated, or too little data. Common for low-traffic sites; not a warning in itself |
| Questionable | Behaviour that may indicate risk. Investigate before going further |
| Untrusted | Exceptionally bad, malicious or undesirable behaviour. Walk away |
Email reputation is reported as Good, Neutral or Poor. Poor means Talos associates the domain or its sending IPs with spam. On a content site, ask the seller whether they ever ran bulk email campaigns and from which service.
Check the content category as well. If Talos files a gardening blog under something unrelated, the domain probably had a previous life.
Step 3: Blocklists
Spamhaus
Run the domain through the Spamhaus reputation checker. The list that matters for a website is the Domain Blocklist (DBL), which lists domains with poor reputation: those used in spam, phishing, fraud or malware distribution, plus those flagged by Spamhaus's wider heuristics.
Spamhaus is widely used by mail providers, so a DBL listing has real consequences. It is also the only place DBL removals are handled, so if the seller says a listing "has been dealt with", the lookup itself will confirm it. A current DBL listing is a stop. A domain that was listed and removed deserves a direct question: when, why, and what changed.
MXToolbox
MXToolbox's blacklist check accepts a domain or a server IP and tests it against over 100 DNS-based email blacklists in one pass.
Run it twice: once on the domain, once on the site's current server IP. A hit on the IP alone often reflects a neighbour on shared hosting rather than the site itself. That is a hosting issue, fixed by moving, not a reputation issue with the asset. Hits on the domain on well-known lists (Spamhaus, SURBL, URIBL) are the ones that count. Hits on one or two obscure lists with no corroboration are usually residual noise.
Step 4: Categories and history
This is the group that catches a cleaned-up domain.
FortiGuard
Fortinet's web filter lookup shows the domain's category and its categorisation history. That second part is what makes it valuable to a buyer: you can see if a domain that is now a finance blog was previously filed under gambling, adult content or malicious websites.
Categories matter beyond reputation. Web filters on corporate, school and public networks block by category. A site categorised as gambling or pornography is simply unreachable for part of its potential audience, whatever its content is today. FortiGuard does accept recategorisation requests, so a stale category on a genuinely clean site is fixable. Price in the uncertainty rather than assuming it.
Symantec Site Review
Site Review, originally Blue Coat's and now part of Broadcom, is the second major category database. Use it to corroborate FortiGuard. Two vendors independently assigning the same unexpected category is strong evidence of past use.
Wayback Machine
The Wayback Machine is not a reputation tool, but it is the primary evidence the other tools are based on: what the domain actually displayed. Check the calendar view for gaps, and open snapshots from before the current site launched. The full method is in the spam history guide.
SpamZilla
SpamZilla was built for expired-domain buyers, which makes it one of the few tools designed around history rather than present state. Its spam checker pulls Wayback Machine snapshots, parking and drop history, and backlink data, then returns one of three results: Checked (no spam detected automatically), Suspicious, or Spam. It also assigns a proprietary SZ Score from 1 to 100, where lower means less spam.
Two cautions. The SZ Score is a proprietary weighted algorithm, so treat it as a triage signal rather than evidence you can show a seller. And by the tool's own documentation you are expected to review the data and mark domains clean or spam manually. "Checked" means nothing obvious was found, not that the domain is proven clean. SpamZilla is a paid product with a limited free tier. Check current plans on its site.
Step 5: Put the results side by side
| Tool | Question it answers | Time window | Cost | Weight in a buying decision |
|---|---|---|---|---|
| Google Safe Browsing | Dangerous now? | Current | Free | High: browser warnings |
| VirusTotal | Dangerous now? | Current, plus community notes | Free | Medium: read vendor names |
| URLVoid | Dangerous now? | Current | Free | Low: corroboration only |
| Cisco Talos | Dangerous now? + category | Current | Free | High for Questionable/Untrusted |
| Spamhaus | On a blocklist? | Current | Free | High: DBL is widely used |
| MXToolbox | On a blocklist? | Current | Free | Medium: separate domain from IP |
| FortiGuard | Used for what? | Current and history | Free | High: history and audience reach |
| Symantec Site Review | Used for what? | Current | Free | Medium: corroborates FortiGuard |
| Wayback Machine | Used for what? | Full history | Free | High: primary evidence |
| SpamZilla | Used for what? | History | Paid, limited free tier | Medium: triage, not proof |
The pattern to look for is disagreement between the current tools and the historical ones. Clean on Safe Browsing, Spamhaus and Talos, but categorised as gambling two years ago in FortiGuard and full of casino pages in the Wayback Machine? That is a laundered domain, and it is exactly the case the current-only tools are blind to.
Searched for "phish.farm"? Read this first
A surprising number of people reach this site after looking up phish.farm. Public WHOIS and threat-intelligence records tie that domain to KnowBe4, a security awareness training company, which uses it to host simulated phishing pages for corporate training. If a link to it appeared in your work inbox, it was most likely a phishing test run by your employer's IT or security team. Your IT team is the right place to confirm that.
It is also a useful lesson for buyers. A domain can sit on phishing lists for a legitimate reason, and a domain with a spotless current score can have an ugly past. A reputation verdict is a data point that needs context: who owns the domain, why it was flagged, and when. That is why this guide groups the tools by question rather than ranking them.
What to Do With What You Find
| Finding | Action |
|---|---|
| Clean across all three groups; categories match the niche; Wayback shows the same niche throughout | ✅ Proceed |
| Talos "Unknown" or "Neutral", everything else clean | ✅ Proceed. Normal for small and mid-size sites |
| One detection on VirusTotal from a minor vendor, nothing corroborating | ⚠️ Note it; confirm with URLVoid and Talos |
| MXToolbox hits on the server IP only | ⚠️ Shared-hosting issue; budget for a host migration |
| Past Spamhaus listing, now removed | ⚠️ Ask the seller when, why, and what changed; get it in writing |
| Talos email reputation "Poor" | ⚠️ Investigate the site's email history before relying on a newsletter |
| FortiGuard history shows an unrelated category, content is now clean | ⚠️ Investigate in Wayback; negotiate on price for the reputational risk |
| Current Google Safe Browsing flag | ⛔ Walk away unless cleared and explained before signing |
| Current Spamhaus DBL listing | ⛔ Walk away |
| Talos web reputation "Untrusted" | ⛔ Walk away |
| History of adult, gambling or malware categorisation in two vendors, confirmed by Wayback | ⛔ Walk away or discount heavily for lost audience reach |
Quick Reference Checklist
- Google Safe Browsing: "No unsafe content found", recent scan date
- VirusTotal: zero detections, or single minor-vendor hits explained; Community tab read
- URLVoid: no corroborating detections; creation date matches the seller's claim
- Cisco Talos: web reputation Neutral or better (Unknown acceptable); email reputation not Poor; category fits the niche
- Spamhaus: domain not on the DBL; any past listing explained
- MXToolbox: domain clean on major lists; IP-only hits attributed to hosting
- FortiGuard: current category fits the niche; categorisation history reviewed
- Symantec Site Review: category corroborates FortiGuard
- Wayback Machine: same niche across the domain's history
- SpamZilla (optional): result reviewed manually, not taken at face value
These checks sit inside the Domain & History section of the website due diligence checklist, alongside the Google penalty check. Run them before you spend time on traffic and revenue. If a domain fails here, the rest of the analysis is academic.