Calculator
Fill the signals you can verify. Unknown values should be conservative.
Example data table
These examples show how different signals can change the risk score.
| Scenario | Days Expired | Spam Signals | Blacklist Hits | Brand Similarity | Expected Risk |
|---|---|---|---|---|---|
| Clean aged domain | 30 | 10 | 0 | 5 | Low |
| Mixed history | 180 | 45 | 1 | 20 | Moderate |
| Abuse indicators | 420 | 75 | 6 | 55 | High/Critical |
Formula used
The calculator converts each input into a 0–100 risk-points value, then computes a weighted average:
How points are derived (examples)
- Days since expiration: linear mapping, capped at 365 days.
- Domain age: older history reduces points, capped at 10 years.
- Blacklist hits: scaled so repeated hits rise quickly.
- Binary flags: malware or penalty sets that component to 100.
How to use this calculator
- Collect signals from reputable tools: archives, backlink audits, and threat feeds.
- Enter values conservatively when uncertain; unknowns should not be optimistic.
- Press Submit to see the risk card above the form.
- Download CSV or PDF for documentation and review workflows.
- Use the contributor list to decide what to verify next.
Why expired domains attract attackers
Expired domains can retain trust signals that outlive the original owner. Threat actors target them because residual backlinks, cached pages, and remembered email addresses can be abused for phishing, malware delivery, and redirect scams. A rushed purchase can inherit silent liabilities, including blocked mail routes, reputation penalties, and customer confusion. Even a clean looking landing page can mask historic abuse in logs and third party feeds.
Interpreting reputation and link signals
Backlink profiles often reveal the previous domain purpose. High exact match anchor percentages, sudden linking spikes, and large shares of low quality referring sites increase the probability of manipulation. Spam scoring and blacklist counts provide a direct view of abuse. Balanced branded anchors, steady growth, and diverse referrers usually reduce risk. Look for topical alignment between links, archived content, and the intended new use.
DNS, hosting, and certificate history indicators
Infrastructure changes are normal during ownership transfers, yet extreme volatility can indicate evasion. Frequent nameserver swings, short lived hosting, or repeated certificate gaps can correlate with disposable campaigns. Consistent TLS use and stable DNS patterns suggest legitimate operations. MX usage history matters because compromised email reputation can persist after reactivation. Reputation recovery typically improves when domains avoid sudden redirects and maintain transparent ownership signals.
Turning signals into a defensible score
This calculator converts each input into standardized points, then applies weights to produce a 0 to 100 risk score. Weighted scoring helps prioritize stronger indicators, such as blacklist hits and malware associations, while still considering contextual factors like age and expiration duration. The output highlights top contributors for targeted verification. Use component points to decide which checks deserve time, budget, and escalation.
Operational next steps after scoring
For low and moderate scores, document checks and proceed with staged deployment. For high and critical scores, run independent threat feed reviews, inspect archives, and validate historical content. Enforce strict email authentication, monitor DNS and outbound links, and avoid brand confusing names. When uncertainty remains, selecting a different domain is often cheaper than remediation. A controlled warm up period and continuous monitoring reduce surprises after launch. Pair the score with manual review of sample backlinks, screenshots from web archives, and mail testing. If critical flags appear, isolate the domain in a sandboxed environment and avoid sending email until reputation is verified by multiple sources.
FAQs
1) What should I do if blacklist hits are nonzero?
Verify hits across at least two trusted sources, then identify the listed IPs, URLs, and dates. If the domain appears repeatedly, avoid buying or plan for long remediation, including hosting hygiene, content rebuild, and ongoing reputation monitoring.
2) Does a high domain age always mean low risk?
No. Age helps only when historical use was legitimate. Older domains can still carry spam backlinks or abuse history. Confirm archives, backlink samples, and reputation feeds before treating age as a safety signal.
3) How do I estimate spam signals without paid tools?
Use multiple free checks: archived snapshots, search results, sample backlink lists, and public blocklists. Look for keyword stuffing, doorway pages, adult or pharma themes, and unnatural anchor patterns. Enter conservative values when uncertain.
4) Why does MX history matter for cybersecurity risk?
Previously used email routing can leave a reputation trail. If attackers abused mail from the domain, deliverability and trust may suffer later. When reactivating email, enforce SPF, DKIM, DMARC, and monitor bounce and complaint metrics.
5) What is DNS volatility and why is it risky?
DNS volatility reflects frequent changes to nameservers or records. Excessive churn can indicate evasive hosting or short lived campaigns. Stable DNS over time usually aligns with legitimate operations, though brief changes during ownership transfer are expected.
6) Should I buy a domain with a Critical score?
Usually no. Critical scores suggest strong abuse indicators or confirmed threats. If you still proceed, isolate the domain, avoid email use initially, run deep forensic checks, and prepare a longer recovery plan than the purchase price.