URL Reputation Lookup — How Vendors Score Your Links
A URL reputation lookup checks how security vendors score a link or domain — clean, suspicious, or malicious — based on signals like malware history, phishing reports, and hosting behavior. You run one by entering your URL into vendor tools or a multi-vendor checker, which queries each blocklist and returns each engine's verdict.
TL;DR: A URL reputation lookup shows whether security vendors trust your link. Scores come from signals like malware history, phishing reports, and domain age — not a single number. Google Safe Browsing alone guards billions of devices (Google), so one poor verdict can block most of your visitors. Fix the underlying issue first, then request re-checks; vendors decide the outcome.
If you've heard your site has a "bad reputation" online, it can sound vague and a little scary. It isn't. Reputation is just a set of verdicts that security vendors assign to your URL, and you can look them up in minutes. This guide explains how that scoring works, where to check it, and how to improve a poor score.
What is a URL reputation lookup?
A URL reputation lookup is a check that asks security vendors how they currently rate a specific link or domain — typically as clean, suspicious, or malicious. Each vendor returns its own verdict, so a single URL can be "clean" at most engines and "flagged" at one. Aggregators like VirusTotal query dozens of engines at once and show the spread.
Reputation isn't one universal score. It's a collection of independent opinions from different vendors, each using its own data and rules. That's why a fair check means looking across many engines, not trusting a single tool. One flag among seventy can still trigger browser warnings, so the spread matters more than any single line.
Most owners assume reputation is a credit-score-style number that slowly rises and falls. In practice, it's closer to a yes/no list per vendor — you're either on a blocklist or you're not. When we scan a domain at unflag, we check it across 124 active security vendors and the result comes back exactly that way: a per-vendor verdict, not an averaged grade. That's good news. Clearing a flag is a discrete action, not a slow climb.
If you'd rather skip the manual hunt across vendor sites, you can check your domain against the major blocklists for free and see every verdict in one place.
How do vendors score URL reputation?
Vendors score reputation by combining signals — malware and phishing history, user and crawler reports, hosting neighborhood, domain age, and content analysis — into a verdict. There's no shared formula; each vendor weights signals differently, which is why verdicts disagree. Google's Safe Browsing, for example, classifies sites by harm category like social engineering or malware, per Google Search Central.
Here are the signals that tend to move a verdict most:
Security history and active threats
The heaviest factor is whether the URL is serving or has recently served something harmful — malware, phishing pages, or deceptive content. Hacked sites are the common trigger. Sucuri's analysis of compromised sites found SEO spam and backdoors among the most frequent infection types (Sucuri, 2023). When a scanner sees injected content, the verdict flips fast.
Reports and crawler detections
Vendors ingest reports from browsers, users, spam traps, and their own crawlers. A page that looks like a fake login form, or a domain sending spam, accumulates negative signals. Phishing remains massive: the Anti-Phishing Working Group recorded over a million phishing attacks in a single quarter (APWG, 2023). High report volume against your domain drags reputation down quickly.
Domain and hosting context
Brand-new domains, domains on shared hosting with bad neighbors, and links using suspicious redirects all draw extra scrutiny. A fresh domain has no track record, so some vendors treat it cautiously until it proves itself. This is why a clean new site can still get a "suspicious" verdict for a while — it hasn't earned trust yet.
In our experience running unflag, the single most common reason for a poor verdict isn't fresh malware — it's leftover injected content the owner thought they'd removed. The hack gets cleaned on the surface, one backdoor file stays, and the scanner keeps scoring the URL as malicious. We don't scan or clean sites ourselves; we trust the owner's cleanup and clear the residual blocklist flags afterward, which is why a half-finished cleanup is the thing that trips people up most.
For a deeper look at how these signals build a longer-term picture, see our guide on how domain reputation works and why it matters.
How do I run a URL reputation check?
Run a URL reputation check by entering your full URL into one or more vendor tools and reading each verdict. Start with a multi-engine aggregator to see the spread, then check the specific vendors that flagged you. Free tools include VirusTotal, which scans a URL against dozens of engines and shows how many call it clean versus malicious (VirusTotal).
A practical sequence works best. Don't just check one tool and assume the result is universal.
Step 1 — Check across multiple vendors at once
Use an aggregator or a multi-blocklist checker first. This tells you how many vendors flag you and which ones — the single most useful piece of information, because it tells you who you'll need to contact later. A one-vendor check can give false comfort or false panic.
Step 2 — Confirm what each vendor actually says
Open the vendors that flagged you and read the category. Is it malware, phishing, social engineering, or something vaguer? The category tells you what the scanner believes it saw, which points you toward what to fix. A "deceptive content" verdict and a "malware" verdict need different cleanups.
Step 3 — Re-check after you've made changes
Reputation tools cache results, so a verdict may lag reality by minutes to hours. After cleaning, re-run the lookup to confirm the underlying detection is gone before you ask anyone to re-review. Requesting a review while the tool still shows malicious usually just restarts the clock.
A quick way to do steps 1 and 2 together is to run a free multi-vendor blocklist check, which lists each vendor's current verdict side by side.
What counts as a poor URL reputation score?
A poor score is any verdict that browsers, email providers, or search engines act on — meaning even one "malicious" or "phishing" flag among many clean verdicts counts as poor. There's no passing percentage. A single Google Safe Browsing flag can interrupt visitors across Chrome, Safari, and Firefox, since Safe Browsing protects billions of devices (Google).
The reason one flag hurts so much is reach, not math. Browser warnings are designed to stop visitors cold, and they work — a large share of people turn back the moment a red interstitial appears. So the question isn't "what's my average score." It's "is any vendor that browsers or mailboxes trust currently flagging me?"
Owners often fixate on getting every single engine to read clean. That's the wrong target. The engines that matter are the ones your customers' tools actually consult — Google Safe Browsing for browsing, major spam lists for email. A flag on an obscure engine nobody queries rarely affects real traffic, while one Safe Browsing flag can halt nearly all of it. Our catalog spans 124 vendors — 78 antivirus engines, 38 web blocklists, and a handful of RBL and search-engine sources — and they genuinely don't carry equal weight. We dispatch a removal request to each one that's flagging you regardless, but the practical priority is always the ones browsers and mailboxes actually check.
If a vendor is flagging you by mistake — a genuine false positive on your website or URL — note that it's a website verdict, not a flagged downloadable file or EXE, which is a separate problem outside what most URL-reputation tools and our service handle.
How do I improve a poor URL reputation score?
You improve a poor reputation in two stages: make the URL genuinely clean, then ask each flagging vendor to re-check it. Skipping the cleanup gets you re-flagged, because vendors re-scan and find the same issue. There's no instant reset and no vendor is obligated to act — each one decides on its own review.
Work through it in order, and don't rush the middle step.
Step 1 — Clean the underlying problem
If a hack caused the flag, the injected content has to go — every malicious file, redirect, and unknown admin user. Use a security plugin, your host's malware tools, or a professional cleanup. Then change passwords and update everything, since attackers reuse the same hole. Important: this cleanup is your job, not ours — we don't scan or remove malware. We help only after the site is clean.
Step 2 — Confirm the verdict reflects a clean site
Re-run your URL reputation lookup and confirm the detection is actually gone. This is the step people skip, and skipping it means going through the whole wait again. Caches can lag, so check more than once before moving on.
Step 3 — Request re-checks from each flagging vendor
Each vendor has its own removal path, and most require a manual review request. Google Safe Browsing, specifically, is cleared only through a manual review in Google Search Console's Security Issues report — there's no API and no automation for it. You clean the site, confirm the fix, then submit the review and wait for Google to re-crawl on its own schedule.
This is where things get tedious if you're flagged by several vendors at once, because each has a different form, email, or portal. A pay-once tool can generate and dispatch personalized removal requests to each flagging vendor for you — what's guaranteed is that the requests get sent, not that any vendor delists you, since that decision is always theirs. Our walkthrough on how to remove your website from a blacklist covers the full sequence vendor by vendor.
How long until a URL reputation score recovers?
Recovery usually takes a few days per vendor after a clean review request, but each vendor sets its own pace and complex cases run longer. Google typically re-crawls and lifts a Safe Browsing warning within days of a review, though it doesn't publish a guaranteed timeline. The biggest delay isn't vendor slowness — it's requesting a review before the site is truly clean.
What you shouldn't expect is automatic recovery. Most vendors won't quietly re-check and clear a flagged URL on their own; they generally need an explicit review request first. Doing nothing tends to mean the flag — and the lost traffic — stays put.
In our experience running unflag, the timeline is mostly self-inflicted. Owners clean most of the problem, request reviews everywhere, get re-flagged on the one leftover file, and conclude the vendors are slow. The fix is patience on step one: confirm a genuinely clean lookup before you ask anyone to re-review. On our side, what we guarantee is dispatch — each flagging vendor gets a unique removal request, sent over a randomized window with your address as Reply-To, and our dashboard shows the real sent, bounced, and failed counts per vendor. The actual delisting decision, and its timing, always belongs to the vendor.
A clear, accurate review request tends to move faster than a vague one. Describe what you cleaned, keep it factual, and check each vendor's verdict after submitting so you know when the score has actually recovered.
A URL reputation lookup checks how security vendors currently score a link or domain — clean, suspicious, or malicious. Each vendor returns its own verdict based on malware history, phishing reports, and other signals. Because verdicts disagree, a fair check uses multiple engines or an aggregator rather than trusting one tool's result.
Enter your full URL into a free aggregator like VirusTotal, which scans it against dozens of engines and shows how many call it clean versus malicious ([VirusTotal](https://www.virustotal.com/)). A multi-vendor blocklist checker lists each verdict side by side, so you instantly see who flags you and which category they assigned.
Usually because a vendor detected something harmful — injected malware, phishing pages, deceptive content, or spam — often from a hack you can't see on the surface. New domains and bad hosting neighborhoods also draw scrutiny. The verdict reflects what a scanner believes it saw, not your intentions, and it sticks until the issue is cleared.
Yes. A single Google Safe Browsing flag can interrupt visitors across Chrome, Safari, and Firefox, since Safe Browsing protects billions of devices ([Google](https://safebrowsing.google.com/)). There's no passing average — any flag that browsers, mailboxes, or search engines act on counts as poor and can block most of your real traffic.
Clean the underlying problem first — remove injected files, redirects, and unknown admin users — then re-run a reputation lookup to confirm the detection is gone. Finally, request a re-check from each flagging vendor; most reviews are manual. Vendors decide the outcome, so accurate review requests after a genuinely clean site matter most.