Malicious domain checker: how to check and block bad domains

Before you check: stay safe

We do not host a lookup tool on this site; this guide shows you how to check a domain with free public services and your own security tools, and how to stop the problem at scale.

First, a few rules that protect you while you investigate:

• Do not open the link in your normal browser, even to "have a look". Copy it carefully, or type it out, rather than clicking.
• Work with the domain name, not the full link, where you can. The domain is the part between the double slash and the next single slash, such as login-portal.example in a longer link.
• Defang it when sharing, for example by writing login-portal[.]example, so nobody clicks it by accident in an email or chat.
• Do not forward the original email to colleagues to ask their opinion; report it through your organisation's process instead.

How to check if a domain is malicious

1. Look up its reputation. The Cisco Talos Intelligence Center on talosintelligence.com offers free reputation lookups for domains and IP addresses, using the same threat intelligence behind Cisco's security products. See Cisco Talos for more about it.
2. Check how old it is. Use a WHOIS or RDAP lookup from a registrar or the domain's registry to see when it was registered. A domain created days ago that claims to be your bank or supplier is a red flag.
3. Read the spelling closely. Look for swapped or extra characters, extra words such as secure, login or verify, different endings, and international characters that look like Latin letters (these often appear as names starting xn-- when written in their raw form).
4. Check your own logs. If you run a DNS security service, search its dashboard for the domain. It will show the category it has been given, whether it was blocked and which users or devices looked it up.
5. Use deeper tools if you have them. Security teams on Cisco Umbrella DNS Security Advantage or a SIG package get Umbrella Investigate, which shows risk scores, WHOIS, passive DNS and related infrastructure for a domain; Cisco Secure Access, Umbrella's successor, has its own Investigate console.
6. Report it. In the UK, you can report a scam website to the NCSC through its report-a-scam-website service, and forward suspicious emails to the NCSC; see how to report phishing.

A clean result does not prove a domain is safe: new domains often have no reputation at all yet. Treat "unknown" as a reason for caution, not a green light.

What makes a domain malicious

Domains in the last row are the hardest to judge, because the domain itself has a good history. That is one of the limits of domain-level checks; a page-level control such as a secure web gateway can see the specific page, as our DNS filtering vs URL filtering guide explains. Malicious domains are also central to most of the DNS attacks we describe, from DNS tunnelling to phishing.

Should you block newly registered domains?

Many phishing and malware domains are used soon after they are registered, so blocking new domains is tempting. The catch is that plenty of new domains are legitimate: a supplier's new campaign site, a new software service, a charity event page.

Cisco's own guidance on its Umbrella Newly Seen Domains category is a good model. The category covers domains queried for the first time in the past 24 hours by any user of the Umbrella DNS service. Cisco notes that a significant portion of these domains are not malicious, and recommends starting in audit or detect-only mode, reviewing what would have been blocked and researching flagged domains before deciding to block.

That approach works with any service that offers a similar category: monitor first, then decide by group. Blocking new domains for guest Wi-Fi or student devices is often reasonable; for finance or marketing teams who deal with new suppliers, you may prefer monitoring and alerting.

Why checking one domain at a time does not scale

A manual check is useful when someone reports a suspicious email. It is no defence on its own, because:

• Staff click links far faster than anyone can check them, and most do not ask.
• Malware and background apps make lookups that no person sees.
• Attackers rotate through new domains constantly, so yesterday's checks do not cover today's campaign.
• A domain can turn malicious after you checked it, if it is compromised or changes hands.

DNS security automates the check for every lookup. Each device sends its lookups to a protective resolver, which compares every domain against continuously updated threat intelligence and your policy and refuses to resolve the bad ones, before a page loads or a file downloads. It covers every app, not just the browser, and with a DNS roaming client it follows laptops off site.

How to block a malicious website for all staff

1. Add the domain to your block list in your DNS security console. It then applies to every device using the protective resolver, in the office and, with roaming clients, off site.
2. Search the logs for anyone who has already looked it up, and check those devices.
3. Block the sender in your email security service if the domain arrived by email.
4. Check the category settings that should have caught it, such as phishing or newly seen domains, and consider tightening them.
5. Tell people, briefly, if a campaign is targeting your organisation, so they know what to look for.

Without a DNS security service, you are left editing firewalls, internal DNS zones or individual devices, which is slow and easy to miss off site. If a domain you rely on is wrongly blocked, use your provider's recategorisation or dispute process (Cisco Secure Access, for example, documents how to dispute a threat categorisation) and add a specific allow-list entry in the meantime.

How we can help

We can set up DNS security so malicious domains are blocked for everyone automatically, with categories, allow lists and alerts tuned to how you work. The options we supply range from Cisco DNS-layer security to DNSFilter, Webroot, ThreatDown and the others on our DNS security solutions page; the NCSC's free protective DNS service is the right starting point if your organisation is eligible. Pricing depends on the product and user numbers, so ask us for a quote. Contact us to start.