Free Online Tools for Looking up Potentially Malicious Websites
A curated list of free online tools for investigating potentially malicious websites, ranging from services that provide historical reputation data to those that examine URLs in real time. Options include VirusTotal for checking databases, urlscan.io for live analysis, and specialized tools for detecting phishing, scams, and malware.
Several organizations offer free online tools for looking up a potentially malicious website. Some of these tools provide historical information; others examine the URL in real time to identify threats:
- AbuseIPDB: Provides reputation data about the IP address or hostname
- Auth0 Signals: Checks IP address reputation; supports API
- BrightCloud URL/IP Lookup: Presents historical reputation data about the website
- CheckPhish: Checks whether the URL is a fraudulent site
- Cloudflare Radar: Provides many details about the system
- CyberGordon: Look up the website (and other observables) across several services
- Desenmascara.me: Flags websites suspected of selling counterfeit products
- Email Blocklist Checker: Checks the domain name or IP address against email blocklists (email address required, opts into marketing).
- FileScan.io: Examines the URL in real time
- FortiGuard lookup: Displays the URL’s history and category
- Google Safe Browsing: Look up the website’s current status
- hashdd: Provides historical data about IPs, URLs, etc.
- IBM X-Force Exchange: Provides historical data about IPs, URLs, etc.
- IPQualityScore: Presents a risk ranking for the IP address
- Joe Sandbox URL Analyzer: Examines the URL in real time
- Ironscales Fake Login URL Scanner: Examines the URL for signs of phishing
- Is It Hacked: Performs several checks in real time and consults some denylists
- IsItPhishing: Assesses the specified URL in real time
- Kaspersky Threat Intel Portal: Looks up the IP, URL, or domain in a denylist
- Norton Safe Web: Presents historical reputation data about the website
- Palo Alto Networks URL Filtering: Looks up the URL in a denylist
- PhishTank: Looks up the URL in its database of known phishing websites
- PolySwarm: Uses several services to examine the website or look up the URL
- Malware Domain List: Looks up recently-reported malicious websites
- MalwareURL: Looks up the URL in its historical list of malicious websites
- McAfee Site Lookup: Checks URL reputation in various McAfee lists
- MxToolbox: Queries multiple reputational sources for information about the IP or domain
- Open Threat Exchange: Presents diverse threat intelligence data from AlienVault
- PassiveTotal: Presents passive DNS and other threat intelligence data
- Pulsedive: Presents historical data and queries for additional information
- Quttera ThreatSign: Scans the specified URL for the presence of malware
- Scamadviser: Checks whether the website is likely a shopping scam
- SecurityTrails: Provides current and historical domain or system data
- Silent Push: Presents diverse threat intelligence data
- Sucuri SiteCheck: Scans the URL for malware in real time and looks it up in several denylists
- Talos Reputation Lookup: Presents historical reputation data about the website
- Trend Micro Site Safety Center: Presents historical reputation data about the website
- ThreatSTOP Check IoC: Looks up the UP or domain in a denylist (requires your email address)
- urlscan.io: Examines the URL in real time and displays the requests it issues to render the page
- URLVoid and IPVoid: Looks up the URL or IP across several services
- VirusTotal: Looks up the URL in several databases of malicious sites
- ThreatMiner: Presents diverse threat intelligence data
- URLscore.ai: Examines the URL in real time
- WebPulse Site Review: Looks up the website in BlueCoat’s database
- Zscaler Zulu URL Risk Analyzer: Examines the URL using real-time and historical techniques
- zveloLive: Looks up the website in its database of categories
Any on-line tools that should be on this list, but are missing? My other lists of on-line security resources outline Automated Malware Analysis Services and Blocklists of Suspected Malicious IPs and URLs.