Is this website safe? AI domain and email check
A short profile of any domain or email address: what it is, who runs it and whether it looks safe. Our checks set the verdict; an AI model explains it in plain words.
By using these tools you accept the Terms and the Privacy page.
How AI domain intelligence works
AI intelligence turns this site’s checks of a domain or an email address into a short profile you can read in a minute. It’s for anyone deciding whether to trust an unfamiliar site, sender or sign-up.
More signals behind the verdict
Google’s Safe Browsing lists count too: a listing for malware, phishing or unwanted software makes a domain Risky, and the extended-coverage phishing list alone makes it Caution. So does a VirusTotal vendor calling it suspicious, or Spamhaus listing it as newly registered. Domain age matters because spammers register domains, use them for a few weeks and drop them: a domain under three months old is never better than Caution, and Risky as soon as any other warning sign shows up. One under a year old gets a note, and the AI is told the age so the profile can mention it. Safe also needs the domain blocklists to have answered. Unknown means no warning sign turned up, but there wasn’t enough independent data to call the domain safe.
Reading the profile
The profile names the kind of site, from business or online store to government, nonprofit or parked, and says “Unclear” when the checks don’t tell. An operator is shown as “Run by” only when it matches the registrant organization in the domain’s registration record; otherwise it reads “Says it is run by”, because a page can claim to be any company. The model’s confidence is shown as high, medium or low, and “What the AI was given” lists every check in plain rows, with the raw data below.
How the evidence is gathered
All checks run at once and share one 20-second deadline; the AI model then has 50 seconds, retry included. A check that fails or is still running at the deadline is shown as unavailable instead of stopping the profile, and such a profile is kept for an hour instead of 24. The homepage is read at https:// and then, if that fails, with www., following up to 5 redirects. If bot protection answers instead, the profile says the content couldn’t be read. Registration comes from RDAP, and up to two website addresses and two addresses of the first listed mail server are checked on IP blocklists.
Verdicts for an email address
An address is rated Valid, Risky, Invalid or Unknown. Invalid means bad syntax, a domain that doesn’t exist or takes no mail, or a mail server that says the mailbox doesn’t exist. Risky covers disposable services, likely typos, role addresses, a missing MX record, catch-all servers and domains our checks rate Risky or Caution. Data leaks never change it. This page doesn’t run the live mailbox check, so here an address is never rated Valid; the full report runs it when you press Check and passes the answer on. Even Valid is a hint, not proof: some servers accept an address and bounce the message later. For the underlying checks, run the email address checker or the data leak check.
Updated · Maintained by Liviu Tanase
Questions
What does AI intelligence do?
It runs our own checks on the domain: registration date, registrar and the registrant organization when the registry publishes it, DNS and the services it reveals, the hosting network, the mail provider, SPF, DKIM and DMARC, domain blocklists and the blocklists of its website and mail server addresses, VirusTotal, Spamhaus’s reputation score, and the homepage: title, description, the organization details the site publishes about itself, its social profiles and about and contact pages, the technologies it uses, where it redirects, and its opening and closing text. Then Claude Sonnet 5.5, Anthropic’s AI model, writes a short profile from those results: what kind of site it is, who runs it, who it serves, what the verdict means and anything that stands out. A separate “Background” line, when shown, comes from the model’s own knowledge rather than our checks.
Who decides whether a domain is safe?
Fixed rules over the checks, never the AI model. Risky: three or more VirusTotal vendors call it malicious, Spamhaus DBL or Abusix lists the domain, two other domain blocklists do, or a domain under three months old shows any other warning sign. Caution: one or two VirusTotal detections, one other domain blocklist, a domain registered in the last three months, a negative Spamhaus reputation, or a website or mail server address on Spamhaus ZEN or two IP blocklists. Safe: none of that, and VirusTotal or Spamhaus has a positive record of it. Otherwise it is unknown. The model only explains the verdict.
How do I check if a website is safe?
Enter its domain or any link to it above. The profile checks Google Safe Browsing, VirusTotal, Spamhaus and other domain blocklists, how old the domain is and what the homepage says it is, then rates it Safe, Caution, Risky or Unknown with the reasons. A domain registered in the last three months is never rated better than Caution, because scam and spam sites are usually new. To look at one signal on its own, run the VirusTotal check, the blacklist check or the domain analyzer.
Can the AI be wrong?
Yes. It writes from the check results, and it can misread a page or a record. Treat the profile as a summary and check anything that matters: every check it was given is listed with the result, and the verdict itself comes from the checks, not the model.
Can a website trick the AI into calling it safe?
Not the verdict: it comes from fixed rules over the checks, and the model is never asked for one. Everything the site says about itself reaches the model as quoted data in a marked block, with the instruction never to follow what it says, and an answer that repeats the model’s own instructions is thrown away. The text the model writes can still be wrong, so the reasons under the verdict list what the rules actually found.
What is sent to the AI model?
For a domain: the domain, our verdict with its reasons, and the check results, including the homepage’s title, description, links and the first 2,000 and last 500 characters of its text. For an email address: the address, its checks and the names, dates and data types of leaks it appears in, never leaked values. They go from our server to Anthropic’s API. Your IP address is never sent.
Why is the profile a few hours old?
Each profile is kept for 24 hours and shared by everyone who checks that domain, because every new profile costs an AI call. “Check again” makes a new one when the saved profile is more than an hour old, and two requests for the same profile at the same moment usually share one AI call. A profile made while a check failed or ran out of time is kept for an hour only. zerobounce.ai’s own logs don’t keep what you check; Cloudflare’s request logs do, as the privacy page explains.
What about an email address?
An address gets its own profile: what kind of address it is (a work address, a role address such as info@, free webmail, a disposable service), who provides its mailbox, whether mail to it should arrive, and how exposed it is in known data leaks. The checks behind it are the address’s syntax and mail servers, the disposable and free-provider lists, role and typo checks, the data leak check (leak names, dates and kinds of data, never the data) and the domain’s own checks. The verdict is Valid only when the live mailbox check, which the full report and the email checker run when you press Check, had the mail server accept the address. The model is told never to identify or describe the person behind an address.