Website blacklist check
Enter a domain to see whether security filters flag it as malware / phishing and whether its server IP is on anti-spam blacklists. Being listed means visitors get blocked and email lands in spam.
What is a blacklist?
Security and anti-spam organisations keep lists of domains and IPs that spread malware, phishing or spam. Browsers, company networks, family DNS filters and mail servers use them to block traffic. Hacked sites often get listed without the owner noticing.
What this tool checks
- Malware / phishing blocklist: Cloudflare's security DNS (1.1.1.2), backed by threat intelligence.
- Anti-spam IP blacklists: SpamCop, PSBL, Mailspike, UCEPROTECT, Barracuda.
- Signs of compromise on the homepage: crypto miners, hidden gambling links, defacement.
Listed? What to do
- Clean the site: remove malware, phishing pages and injected links; change admin and hosting passwords; update the CMS and plugins.
- If the IP sends spam, find the compromised account or script.
- Request a review: Google Search Console (Security issues), Cloudflare Radar, and each blacklist's delisting page.
Spamhaus doesn't allow lookups through public DNS resolvers, so it isn't included.
Check your whole site, not just one thing
The free scan checks SSL, email spoofing, security headers, exposed sensitive files, outdated CMS and signs of hacking in one go, with plain-language fixes.
Free once you verify your domain: weekly re-scans and email alerts for new issues. PRO ($8/month): deep scan with 5,000+ known-vulnerability checks, deep re-scans up to 10 times a day and 5-minute uptime monitoring.
FAQ
My site doesn't send email. Do IP blacklists matter?
Yes if the site shares an IP with a mail server (e.g. shared hosting). The malware / phishing blocklist matters even more: being listed gets your site blocked on many networks.
How long does delisting take?
Usually a few hours to a few days after the fix and the request. Some lists expire entries automatically.