Free Domain Reputation Check: Risk & Trust Score Tool

When a domain appears in your logs, inbox, or threat feed, you need to know instantly whether it is safe, suspicious, or malicious. Visiting the site manually is risky. Checking static blocklists misses new threats. Running four separate lookups for WHOIS, DNS, SSL, and threat intel is slow.

The WhoisFreaks Domain Reputation API solves this with a single call. It runs six checks simultaneously, including live threat database lookup, DNS analysis, WHOIS registration data, SSL certificate inspection, page content analysis, and DGA scoring, and returns a unified verdict, a 0 to 100 trust score, and a plain-English explanation of exactly why a domain was flagged.

This tutorial shows you how to use it, how to read the response, and how to integrate it into your workflow.

What the Domain Reputation Check Returns

Every domain reputation check returns the following top-level objects:

Method 1: Free Domain Reputation Tool (No Account Needed)

Step 1 - Go to the Tool

• Visit Domain reputation tool
• No account or credit card is required for basic free lookups.

Step 2 - Enter the Domain Name

Type the domain you want to check into the search field:

suspicious-site.top

Step 3 - Click Check

Results are returned in under 2 seconds. The tool runs all six checks in parallel and displays the verdict, trust score, and evidence summary immediately.

Step 4 - Read the Verdict

The verdict is the first thing to look at:

Step 5 - Read the Trust Score

The trust score is a number from 0 to 100 calculated from a base of 50 with signals adding or subtracting points. It falls into one of three bands:

Step 6 - Read the Evidence Summary

The evidence_summary.why_flagged field gives you plain-English reasons for the verdict. For example:

• "Direct match in threat feeds as phishing"
• "Pivot [email protected] (email) linked to 134 malicious domains"
• "High DGA score (0.82) suggests algorithmically generated domain"
• "Low trust score (12/100)"

If the domain is clean, this array is empty.

Method 2: Domain Reputation API

For programmatic access, SIEM enrichment, or integrating reputation checks into your own application, use the Domain Reputation API.

Step 1 - Sign Up and Get Your API Key

Follow this step-by-step tutorial to create your account and get your API key in under two minutes:

How to Sign Up and Get Your API Key

Step 2 - Make the Request

Endpoint:

GET https://api.whoisfreaks.com/v1/domain/security?domainName=example.com&apiKey=YOUR_API_KEY

Parameters:

cURL Example:

curl -s "https://api.whoisfreaks.com/v1/domain/security?domainName=example.com&apiKey=YOUR_API_KEY"

Step 3 - Handle the Response

A clean domain returns a response like this:

{
  "input": { "domain": "whoisfreaks.com" },
  "assessed_at": "2026-07-07T12:00:00Z",
  "processing_time_ms": 1250,
  "risk_category": {
    "verdict": "safe",
    "confidence": 0.8,
    "primary_threat": null,
    "severity": "none",
    "threat_types": [],
    "sources": [],
    "pivot_matches": []
  },
  "trust_signals": {
    "trust_score": 73,
    "trust_band": "high"
  },
  "evidence_summary": {
    "why_flagged": []
  },
  "errors": []
}

A malicious domain returns a response like this:

{
  "input": { "domain": "evil-phishing-site.top" },
  "assessed_at": "2026-07-07T12:01:00Z",
  "processing_time_ms": 890,
  "risk_category": {
    "verdict": "malicious",
    "confidence": 0.95,
    "primary_threat": "phishing",
    "severity": "high",
    "sources": [
      {
        "source": "seed_threat_data",
        "indicator": "evil-phishing-site.top",
        "threat_type": "phishing",
        "confidence": 0.95,
        "first_seen": "2026-06-15T00:00:00Z",
        "last_seen": "2026-07-05T00:00:00Z"
      }
    ],
    "pivot_matches": [
      {
        "pivot": "[email protected]",
        "pivot_type": "email",
        "total_related_threats": 134,
        "confidence": 0.7
      }
    ]
  },
  "trust_signals": {
    "trust_score": 0,
    "trust_band": "low"
  },
  "evidence_summary": {
    "why_flagged": [
      "Direct match in threat feeds as phishing",
      "Pivot [email protected] (email) linked to 134 malicious domains",
      "Low trust score (0/100)"
    ]
  },
  "errors": []
}

Understanding the Full Response

risk_category

This is the core verdict block. The key fields are:

How pivot matches work: If a domain's registrant email is also used to register 47 known phishing domains, that connection appears in pivot_matches with total_related_threats: 47. This is how the API catches new malicious domains before they appear in any threat feed.

trust_signals

The trust score starts at 50, and signals add or subtract points. Here are all the signals that affect the score:

The final score is capped between 0 and 100.

dga_score

DGA stands for Domain Generation Algorithm. Malware families use DGA to generate hundreds of random-looking domain names programmatically, making them hard to block.

The API scores each domain for DGA likelihood using seven features:

The result is interpreted as:

intelligence

This object contains threat intelligence output in formats ready for SIEM and SOAR integration.

Example STIX pattern:

[domain-name:value = 'evil-phishing-site.top' OR ipv4-addr:value = '45.33.32.156']

indicators

A set of quick boolean and integer checks for common risk signals:

Note: Fields that depend on a lookup show null if that lookup failed. For example, is_newly_registered is null if the WHOIS lookup did not return data.

errors

If any individual lookup fails, the rest of the response still completes. Failed components are reported as strings in the errors array:

"errors": ["SSL lookup failed"]

An empty array means all six checks completed successfully.

Frequently Asked Questions

Is the domain reputation check free?

Yes. The free tool at whoisfreaks.com requires no account or credit card. For API access, sign up for a free account and receive 500 credits with no credit card required.

How long does a domain reputation check take?

Typically, under 2 seconds. All six checks (threat database, DNS, WHOIS, SSL, content analysis, and DGA scoring) run in parallel. The maximum timeout is 10 seconds per request.

What is the difference between verdict and trust score?

The verdict is a categorical classification (safe, suspicious, malicious etc.) determined by a priority chain of conditions. The trust score is a 0 to 100 numerical score calculated by adding and subtracting weighted signal points from a base of 50. Both are included in every response and complement each other.

What is a pivot match?

A pivot match is an indirect threat association discovered through shared WHOIS or DNS attributes. For example, if the domain being assessed uses the same registrant email as 47 known phishing domains, that shared email is the pivot and total_related_threats is 47. This catches new malicious domains before they appear in any threat feed directly.

What is DGA detection?

DGA stands for Domain Generation Algorithm. Malware families generate random-looking domain names programmatically to avoid blocklists. The API scores every domain for DGA likelihood using seven features including Shannon entropy, character bigram perplexity, vowel ratios, consonant streaks, digit ratios, domain length, and TLD patterns. No external API call is needed as this runs locally in microseconds.

What does the STIX pattern field do?

The stix_pattern field in the intelligence object contains a STIX 2.1 compliant pattern combining the assessed domain and all resolved IP addresses. This pattern can be imported directly into Splunk, Microsoft Sentinel, IBM QRadar, MISP, OpenCTI, Palo Alto XSOAR, and any other STIX 2.1 compatible platform.

What happens if one of the lookups fails?

The response still completes with data from the remaining lookups. If the SSL lookup fails, for example, the verdict and trust score are still calculated using the threat database, DNS, WHOIS, and content analysis results. The failed lookup is reported in the errors array.

What threat types does the API detect?

The API detects malware, phishing, command and control (c2), botnet, and spam domains through its threat intelligence database.

Conclusion

The WhoisFreaks Domain Reputation API runs six checks in parallel and returns a single, explainable verdict in under 2 seconds. The trust score, pivot associations, DGA analysis, and STIX pattern make it suitable for everything from a quick manual check on one domain to fully automated SIEM enrichment across thousands of alerts.

• Try the free Domain Reputation Check tool 
• Read the full API documentation