{{ result.summaryTitle }}
{{ result.primaryDisplay }}
{{ result.secondaryText }}
{{ result.liveHitCount }} live hits {{ result.completedChecks }} completed checks Local {{ result.localSignalScore }} / 100 {{ result.accessLimitedCount }} access-limited sources Apex {{ result.rootDomainCandidate }}
Accepted: https://example.org/path or example.org/login.
Load a sample, then edit the URL or switches before checking.
Leave off when you only need SURBL and local string signals.
{{ advanced.include_google_safe_browsing ? 'On' : 'Off' }}
Example scope: login.mail.example.org.
{{ advanced.include_surbl_host ? 'On' : 'Off' }}
Adds example.org when the input host is login.mail.example.org.
{{ advanced.include_surbl_root ? 'On' : 'Off' }}
Turn on when plain HTTP should count more strongly in triage.
{{ advanced.strict_https ? 'On' : 'Off' }}
Accepted values: 7, 30, 90, or 365 days.
Allowed range: 1500 to 15000 ms in 500 ms steps.
ms
Source Scope Verdict Evidence Checked Open Copy
{{ row.source }} {{ row.scope }} {{ row.verdict }} {{ row.evidence }} {{ row.checked }}
Recommendation
{{ result.primaryDisplay }}
{{ result.recommendation }}
Live coverage
{{ result.completedChecks }} completed
{{ result.statusText }}
{{ result.liveHitCount }} live hits {{ result.accessLimitedCount }} access-limited Apex {{ result.rootDomainCandidate }}
Local signal posture
{{ result.localSignalTier }}
{{ result.coverageLead }}
Score {{ result.localSignalScore }} / 100 {{ result.signalCount }} triggered signals
Field Value Copy
{{ row.label }} {{ row.value }}
Signal Weight Why it fired Copy
{{ row.label }} {{ row.weight }} {{ row.detail }}
No local risk signals fired for the normalized URL string.
Scope What ran What it tells you Blind spot Copy
{{ row.scope }} {{ row.checks }} {{ row.insight }} {{ row.blindSpot }}
Follow-up Scope Why open it Open Copy
{{ row.label }} {{ row.scope }} {{ row.note }} 

        

      

    


  



                

                

                    

                        

                            Tags: DNS, Diagnostics, Networking, Security
                        

                        

                            Export to PDF
                            Fullscreen
                        

                    

                

            

        

    


        
    

        

        

            


                

                    

                    
                


                

                

                
            

            

                
                
            

        

    


    

        

                                                                                                                                                                                                                                                                        
        

            

                
                
                
                
            

            

                
                
            

            

                

                    

                        

                            
                            
                        

                    

                    

                        

                            
                            
                        

                    

                    

                        

                            
                            
                        

                    

                    

                        

                            
                            
                        

                    

                    

                        
                        
                    

                    

                        
                        

                            
                            
                        

                    

                    

                        
                        

                            
                            
                        

                    

                    

                        
                        

                            
                            :
                            
                        

                    

                    

                        
                        

                            
                            
                        

                    

                    

                        
                        
                    

                    

                        
                        
                    

                    

                        

                            
                            
                        

                    

                    

                        
                        
                    

                    

                        
                        
                    

                

            


            
        

    



    

        

  

  
URL reputation checks combine live list lookups with careful reading of the URL string. A clean result from one source does not prove a link is safe, and a listed host may need confirmation before action. The useful result is a triage view that separates exact-URL coverage, host reputation, root-domain reputation, and local risk signals.


  
Suspicious links often hide risk in the scheme, hostname, path, query string, redirect parameters, punycode, non-default ports, or deep subdomains. Public reputation sources add another view, but they can lag new campaigns or return limited access from some query paths.


  

    Diagram showing URL normalization, host scope, reputation lists, local signals, and triage result
  


  
Reputation output should guide handling, not replace security policy. Unexpected login, payment, password reset, invoice, or wallet links should still be opened only in an approved sandbox or investigation workflow.






  
Technical Details:


  
The lookup normalizes an HTTP or HTTPS URL, prepending HTTPS when no scheme is supplied. It extracts the hostname, root-domain candidate, port, path depth, query keys, encoded octets, and host class. It then runs enabled live checks and a local string review.


  
Google Safe Browsing is checked at exact-URL scope through the public Transparency Report status endpoint. SURBL checks the exact host and root-domain candidate through DNS lookups under multi.surbl.org. The local pass scores URL properties such as non-HTTPS transport, userinfo, punycode, private or special-use hosts, non-default ports, credential-lure terms, redirect parameters, heavy percent encoding, long URLs, deep subdomains, deep paths, digit-heavy hostnames, and long queries.


  

    

      
      
SourceScopeImportant limit

      
        
Google Safe BrowsingExact normalized URLA clear exact URL does not clear sibling paths or future changes.

        
SURBL exact hostHostname as enteredDomain-oriented, so IP literals are skipped.

        
SURBL root candidateHeuristic parent domainUncommon suffixes may need manual registrable-domain confirmation.

        
Local signal passURL stringFlags suspicious structure but cannot prove malicious content.

      
    

  


  
SURBL A records encode list membership in the last octet. For example, phishing and abuse categories are represented by bitmask values. A response of 127.0.0.1 means the query path is access-limited and should not be treated as a listing or a clear result.


  
The tool prepares follow-up links for Google Transparency Report, URLVoid, urlscan host and apex searches, and Sucuri SiteCheck. Those links are investigation aids, not live verdicts inside the result.






  
Everyday Use & Decision Guide:


  
Use the homepage, login path, plain HTTP, punycode, and deep subdomain presets to see how each signal behaves, then replace the preset with the link you need to triage. Keep Google Safe Browsing and both SURBL scopes enabled for a first pass unless you have a reason to narrow the run.


  
    
    
  • Treat Listed or Unsafe as a stop signal until confirmed in your managed tools.
    • 
    
  • Treat Access limited as unknown, not clear.
    • 
    
  • Use Triggered Signals to explain why a clean live-list result still needs review.
    • 
    
  • Use the public-history window to prepare urlscan follow-up searches for the last 7, 30, 90, or 365 days.
    • 
  


  
Do not open a suspicious link directly just because the headline says no listing. The result only covers the enabled sources and the current normalized URL.






  
Step-by-Step Guide:


  
    
    
  1. Paste a full URL, hostname, or path-like URL into the target field.
    2. 
    
  2. Choose a preset only if you want to load a sample pattern.
    3. 
    
  3. Open Advanced to enable or disable Google Safe Browsing, exact-host SURBL, root-domain SURBL, strict HTTPS review, timeout, and history window.
    4. 
    
  4. Run the lookup and read Source Verdict Table before the local signal score.
    5. 
    
  5. Use Coverage Matrix and Follow-up Links for manual confirmation.
    6. 
  

  
If the input is not HTTP or HTTPS, correct the scheme. Other protocols are not supported by this lookup.






  
Interpreting Results:


  
No Listing means enabled live sources did not report a listing and the local score did not force a stronger warning. It does not mean safe. Review means the string itself carries enough suspicious structure to slow down. Partial means at least one live source failed.


  
The best verification cue is source agreement. If Safe Browsing, SURBL host, SURBL root, and local signals all point the same way, confidence rises. If they disagree, preserve the URL and use the follow-up links or your security stack.






  
Worked Examples:


  
A normal homepage such as https://example.org/ should produce documentation-host local signals and clear or skipped public-list rows. That is a reminder that reserved example domains are not useful reputation targets.


  
A password reset link over plain HTTP with next= in the query can show no live listing while still triggering non-HTTPS, credential-lure, and redirect-parameter signals. The practical result is review-needed until the destination is verified.


  
A deep campaign subdomain may be clear at exact-host scope while the root-domain candidate has a SURBL listing, or the reverse. Read the scope column before deciding whether the risk belongs to the full URL, host, or parent domain.






  
FAQ:


  
Does no listing mean the URL is safe?
No. It means the enabled sources did not return a live hit for the checked scope at that time.

  
Why are IP addresses skipped for SURBL?
SURBL is domain-oriented. IP-literal hosts do not fit that lookup path, so local signals and other follow-up checks matter more.

  
What should I do with access-limited SURBL output?
Treat it as inconclusive. Re-run through an allowed resolver or use the prepared follow-up links before closing the case.






  
Glossary:


  

    
Exact URL
The full normalized URL string, including path and query.

    
Root-domain candidate
The parent-domain guess used for broader reputation lookup.

    
Local signal score
A static score based on URL structure, not a live blacklist result.

  






  
References: