URL Reputation Lookup: How Security Vendors Score Your Links

How do security vendors decide whether a URL is safe? Learn how URL reputation scores work, which signals matter and how to look up and improve your own link reputation.

Every time someone clicks your link in an email, chat or ad, a security product quietly checks its reputation. A good score means the link opens. A poor score means a warning, a spam folder or a block page.

This guide explains how vendors calculate URL reputation, how to look up your own and how to improve it.

Key takeaways

  • URL reputation combines domain age, hosting, content, behaviour and history.
  • Vendors score at three levels: the exact URL, the domain and the IP address.
  • VirusTotal is the quickest multi-vendor lookup, but web filter categories need their own checks.
  • A low score can be raised: fix the signals, then request a reclassification.

Three levels of reputation

Vendors score links at three levels, and a problem at any one can block you:

  1. The exact URL, for example a single landing page or download link.
  2. The domain, covering every page and subdomain.
  3. The IP address your site is hosted on, shared with other sites on shared hosting.

The signals vendors use

Although every vendor has its own model, the same signals come up again and again:

  1. Domain age and registration: new domains and short registrations score lower.
  2. Hosting neighbourhood: an IP shared with malicious sites drags your score down.
  3. Page content: login forms, payment fields and brand names are compared with phishing templates.
  4. Behaviour: redirects, pop-ups, downloads and obfuscated scripts raise suspicion.
  5. History: previous listings, abuse reports and spam campaigns linger.
  6. Popularity and links: established sites with real traffic score higher.

Machine-learning vendors such as alphaMountain.ai combine hundreds of these signals into a single score, which is why clean sites sometimes cross the threshold.

How to look up your URL reputation

Use several sources, because no single tool covers every vendor:

  1. VirusTotal shows 90+ vendor verdicts for the URL and the domain. Our link checker guide explains how to read it.
  2. Google's Safe Browsing status page and Search Console show whether Chrome will warn visitors.
  3. Web filter vendors such as Fortinet, Cisco Talos and Palo Alto Networks offer public category lookups.
  4. Email reputation services such as Spamhaus show whether your domain appears on mail blocklists.

Category versus verdict

Web filters assign a category, such as Business, Shopping or Newly Registered, as well as a safety verdict. A wrong category can block you even with a clean verdict, for example if your site is categorised as Proxy or Phishing by a corporate filter. Category changes are requested separately from false positive disputes.

How to improve a low score

Fix the signals you control first: remove unnecessary redirects, reduce third-party scripts, add clear contact and company information, keep SSL valid and avoid URL shorteners for important links. Then request a review or reclassification from each vendor with a low score. Our false positive reporting guide shows what to include.

Frequently asked questions

Is there one universal URL reputation score?

No. Each vendor calculates its own. VirusTotal shows many of them side by side, but not all web filters.

How often do reputation scores change?

Constantly. Most vendors update scores daily or in real time as new data arrives.

Can link shorteners hurt my reputation?

Yes. Shorteners are abused by attackers, so links through them are often scored lower or blocked.

Does a good URL reputation help email deliverability?

Yes. Mail filters check the reputation of links inside messages, so a clean domain improves inbox placement.