How to use Suspicious Domain Checker
- Enter a domain nameType a domain such as example.com into Domain name, or paste a full URL; only its host name is checked.
- Run the checkPress Run Suspicious Domain Checker.
- Review the signalsAny warning signs are listed; otherwise you see No simple risk signals. Treat this as a first screen, not a verdict.
Common uses
- Taking a first look at a link in an unexpected email
- Spotting punycode look-alike domains
- Screening a list of domains before deeper research
Frequently asked questions
How do I use Suspicious Domain Checker?
1. Enter a domain name: Type a domain such as example.com into Domain name, or paste a full URL; only its host name is checked. 2. Run the check: Press Run Suspicious Domain Checker. 3. Review the signals: Any warning signs are listed; otherwise you see No simple risk signals. Treat this as a first screen, not a verdict.
What signals are checked?
Nine: whether it looks like a valid domain name, is longer than 45 characters, uses punycode (xn--) or unusual characters, has four or more digits in a row, has five or more name levels, has three or more hyphens, ends in a top-level domain common in abuse reports, contains a well-known brand name outside that brand’s own domain, or imitates one with look-alike characters such as 0 for o.
Does it check blocklists, WHOIS or the website itself?
No. It only looks at the spelling of the name you enter. It does not look up DNS, registration date, reputation lists or the site’s content, so a clean result does not mean a domain is safe.
Can I paste a full URL?
Yes. The scheme, path and query are removed first, and so is a leading www., so only the host name is checked.
Is the domain sent to a server?
Yes. It is sent to the GigaTools server, which runs the text checks and returns the signals. No other service is contacted and the domain is not saved.