VirusTotal domain check
See whether security vendors flag a domain for malware, phishing, spam or anything suspicious, what each one says, and how VirusTotal’s community rates it.
By using these tools you accept the Terms and the Privacy page.
How the VirusTotal domain check works
The VirusTotal check shows what security vendors say about a domain, from the report VirusTotal keeps for it. It’s for anyone deciding whether to trust a link or a sender, and for site owners who want to know whether their own domain has been flagged before visitors or customers notice.
What the verdict words mean
The verdict comes from these vendor counts alone. A leading www. is dropped before the lookup, so www.example.com is checked as example.com, while other subdomains are looked up as typed.
- Malicious: three or more vendors call the domain malicious.
- Flagged: one or two vendors call it malicious and the rest don’t.
- Suspicious: no vendor calls it malicious, but at least one calls it suspicious.
- Clean: no detections, and at least one vendor rates it harmless.
- Not rated: no vendor flags the domain, and none rates it harmless. That is neither a warning nor a clean bill; the domain is simply little known to them.
Each vendor’s answer
A vendor can answer malicious, suspicious, clean, no opinion, timed out or unsupported. “No opinion” means the vendor has nothing on the domain, so it never counts toward a clean result. Findings name every vendor that says malicious and every vendor that says suspicious, with what each one reports, such as phishing or malware, and the headline repeats the most common of those labels. A table of the flagging vendors follows, and every vendor’s answer is in a collapsible table further down.
The context around the counts
Categories show how vendors classify the site, one line per vendor. A category that mentions phishing, malware, spam, scams, fraud, botnets, command and control, crypto mining or ransomware is raised as a finding, even when no vendor flags the domain. The community score is VirusTotal’s rating from its users, shown with the number of harmless and malicious votes; a negative score is raised as a finding too.
You also see popularity ranks, each with the list it comes from, the tags VirusTotal assigns, a first-seen date, the date of its last analysis in UTC, and a link to the full report on VirusTotal. The plain-text report you can copy repeats the counts, each flagging vendor and its label, the categories and that link.
Freshness and what to check next
The line under the verdict says when this site fetched the report from VirusTotal. Compare it with the last-analysis date to see how old the vendors’ answers are. A “no report” answer is kept for an hour rather than six, so a newly submitted domain shows up sooner, and the page links to the domain on VirusTotal so you can submit it for a scan there. Until the shared copy expires, “Check again” returns the same report.
Each check has 15 seconds. If VirusTotal hasn’t answered by then, or this site’s free keys have used their lookups for the minute or the day, the page says so and shows no verdict. A lookup VirusTotal didn’t answer isn’t counted against the day.
VirusTotal is one view among several. To see whether DNS blocklists list the domain, run the blacklist check. For Google’s lists, which browsers use for their full-page warnings, run the Google Safe Browsing check.
Updated · Maintained by Liviu Tanase
Questions
What does this check?
It reads VirusTotal’s report for the domain: the latest verdict of each of about 90 security vendors (antivirus companies, URL blocklists and threat-intelligence feeds), the categories vendors assign, and the community score from VirusTotal users. It doesn’t scan the site itself or open any link.
How should I read the result?
Three or more vendors calling a domain malicious is a strong signal: treat its links as dangerous. One or two detections are often false positives, especially for new domains or shared hosting, so look at what each vendor says. “Suspicious” is weaker than malicious. A clean result means no vendor flags it today; brand-new phishing sites can go unnoticed for hours.
Why is the result a few hours old?
VirusTotal’s free API allows only a few lookups a minute, so each domain’s report is kept for 6 hours and shared by everyone who checks it. The date VirusTotal last analysed the domain is shown with every result. For a fresh analysis, open the domain on VirusTotal and ask it to rescan.
My domain is flagged by mistake. How do I fix it?
VirusTotal only shows what each vendor reports, so the listing has to be fixed by that vendor. Find the vendor’s false-positive or review form, explain what the domain is, and ask it to re-check. Clean up first if the site was compromised. VirusTotal picks up the change at its next analysis.
What does “VirusTotal has no report” mean?
No one has submitted or scanned the domain on VirusTotal yet, so no vendor has a verdict. That is common for new or little-used domains and says nothing either way about safety.
Can I check a link or an IP address?
Paste a link or an email address and its domain is checked: VirusTotal’s domain report covers the whole domain, not one page, and only the domain goes to VirusTotal. IP addresses aren’t accepted here; the blacklist check takes them. To check one exact link against Google’s lists, use the Google Safe Browsing check, and the redirect trace shows where a link really leads.
Who sees the domain I check?
The domain is sent from our server to VirusTotal (owned by Google) as a lookup of the report it already has; nothing is submitted for a new scan. VirusTotal may keep a record of lookups. Your IP address isn’t sent and the API keys stay on our server. Each report is kept in this site’s cache for up to 6 hours; the privacy page says what else is kept.