Malicious Domain Detection Calculator

Domain signals

Example data table

Formula used

The calculator assigns points to each indicator and sums them into a capped score: Risk Score = min(100, Σ signal_points).

• Domain age: 0–15 points (newer = higher risk).
• TLD risk: 0–10 points (low/medium/high).
• WHOIS privacy: 0 or 5 points.
• DNSSEC: 0 or 4 points (missing increases risk).
• SSL/TLS: 0–10 points (no HTTPS is highest).
• Redirects: 0–10 points (long chains are riskier).
• MX records: 0 or 3 points (missing can be suspicious).
• Blacklist hits: 0–20 points (4 points per hit, capped).
• Typosimilarity: 0–15 points (scaled from 0–100).
• Homoglyph: 0 or 10 points (deceptive characters).
• Parked site: 0 or 5 points.
• Registrar reputation: 0–8 points.
• Hosting risk: 0–8 points.
• Geo mismatch: 0 or 4 points.
• Newly observed: 0 or 6 points.
• Popularity: 0–6 points (lower = higher risk).

Why domains become malicious

Malicious domains are often created for short campaigns that harvest credentials, deliver malware, or redirect victims to scam checkout pages. Attackers benefit from low setup cost and high turnover, so domain age becomes a strong early signal. Domains registered within 30 days are disproportionately used in phishing waves, especially when combined with privacy-protected registrations and thin web content. Abuse can cluster within registrars and hosting providers where enforcement is slow.

High-signal indicators for triage

This calculator weights observable indicators gathered quickly: blacklist detections, typosquatting similarity, HTTPS posture, redirect chain length, and homoglyph patterns. Multiple independent blacklist hits increase risk, while high similarity scores indicate impersonation attempts. Long redirect chains can hide landing pages and frustrate crawlers. DNSSEC absence, missing MX, and elevated network risk add context when infrastructure looks disposable or repurposed.

Interpreting the risk score bands

Scores are capped at 100 and grouped into Low, Moderate, High, and Critical. Low scores generally reflect older domains, valid certificates, minimal redirects, and no detections. Moderate scores suggest mixed signals that warrant monitoring. High and Critical scores indicate converging evidence and justify immediate controls, evidence capture, and escalation when users may have interacted. The confidence percentage increases as more fields are populated, indicating assessment completeness.

Operationalizing results in security workflows

Use the breakdown table to document why a domain was blocked or allowed. In ticketing systems, attach the CSV or PDF export alongside passive DNS results, certificate transparency findings, and email header artifacts. Consistent scoring supports analyst handoffs and reduces decision drift across shifts, especially during high-volume phishing events. Pair the score with exposure indicators, such as click counts, delivery volume, and endpoint connection attempts during rapid incident triage cycles.

Reducing false positives over time

Every environment has benign edge cases, such as new marketing domains, rebrands, or temporary redirects from CDNs. Reduce noise by standardizing how unknown fields are handled and by adding local allowlists for verified business domains. Re-score domains periodically as they age, certificates change, and reputation signals evolve, then tune internal thresholds accordingly. Track outcomes by verdict band and review weekly, keeping evidence sources consistent to maintain comparability over time.

FAQs

1) What score should trigger blocking?

Use local policy, but High and Critical usually justify blocking at DNS or gateways. Consider user exposure, business impact, and whether multiple signals agree before taking broad action.

2) Does WHOIS privacy always mean abuse?

No. Many legitimate owners use privacy. Treat it as a weak signal that matters more when paired with new registration age, detections, or strong impersonation indicators.

3) How do I estimate typosquatting similarity?

Compare the domain to the intended brand using edit distance, keyboard adjacency, or visual similarity. Higher similarity, especially with brand terms and lookalike characters, increases impersonation likelihood.

4) Why do redirects increase risk?

Redirect chains can conceal the final landing page, rotate payloads, and bypass simple scanners. Higher counts also correlate with affiliate fraud and traffic laundering infrastructure.

5) What does the confidence percentage represent?

It reflects how many fields were filled in this calculator. Higher completeness generally improves decision quality, while low confidence suggests collecting more signals before acting.

6) Can a low score still be dangerous?

Yes. Sophisticated attackers can use aged domains or compromised infrastructure. If user behavior, content inspection, or telemetry indicates harm, treat the domain as suspicious regardless of score.