Domain reputation check

Critical IP abuse: high confidenceNeeds a licence key

AbuseIPDB aggregates community reports of malicious IP addresses

How to fix it: If the listed IPs are yours, audit outbound traffic and authentication logs for compromise. Rotate the IPs where possible; for shared/cloud IPs, work with your provider to clean the IP reputation or migrate to a different IP block.

Active botnet command-and-control detected

Feodo Tracker records IPs serving as command-and-control for banking trojans and loaders such as Emotet, Dridex, TrickBot and QakBot. An "online" entry means the C2 was responding recently.

How to fix it: Treat as a live incident. Isolate the host, capture volatile evidence before rebuilding, and hunt for the associated malware family across the estate. Do not simply re-image and return the IP to service without finding the initial access route.

Domain flagged by Google Safe BrowsingNeeds a licence key

Google has classified this domain as dangerous. Safe Browsing is not a reputation score or a heuristic: a listing means Google's systems observed harmful content being served.

How to fix it: Open Google Search Console and check Security Issues for the property; it names what was found and where. Remove the content, then find how it got there: usually an outdated CMS plugin, a compromised admin account, or a writable upload directory. Only then request a review. Requesting review without fixing the cause results in a faster re-listing.

Domain flagged for phishing by Google Safe BrowsingNeeds a licence key

Google has observed this domain hosting a page designed to trick visitors into surrendering credentials or personal information.

How to fix it: Treat this as a compromise until proven otherwise: a phishing page on your domain means someone else could write files to it. Take the content offline, rotate all credentials for the host and CMS, review file-upload paths and any recently modified files, then request a review through Search Console.

Domain flagged as malicious by AlienVault OTXNeeds a licence key

OTX pulses contain threat intelligence about malware, phishing, and malicious activity

How to fix it: Investigate the linked OTX pulses to determine whether the listing reflects past compromise, hosting-neighborhood reputation, or an active threat. Engage your SOC to scan internal logs for matching indicators, rotate any infrastructure (IPs, certificates) that appears in malicious pulses, and file a clearance request with AlienVault if the listing is stale.

Domain actively hosting malwareNeeds a licence key

URLhaus tracks malicious URLs used for malware distribution

How to fix it: If the listed URLs point to your infrastructure, assume compromise: pull the affected pages, audit web-server access logs, and rebuild from clean images. Submit takedown requests to your hosting provider, then request URLhaus delisting once the malicious content is removed and verified clean.

Domain listed as confirmed phishing

Phishing.Database aggregates confirmed phishing hostnames from multiple public reporting sources. A listing means this exact hostname was reported hosting a phishing page.

How to fix it: Find and remove the phishing content: it is commonly an abandoned CMS plugin or a compromised upload directory. Once removed, request delisting from the upstream reporters, and audit for the web-shell or credential that allowed the upload.

High-Risk threat categories identifiedNeeds a licence key

Tags like "malware", "phishing", "ransomware" indicate specific threat types

How to fix it: Map the listed tags to your existing detection coverage. If phishing or credential-theft appears, run a phishing-simulation campaign and verify Safe Links / URL-rewriting policies are active; if ransomware or c2, audit network egress filtering and EDR alerting on those indicators.

Recent malware indicator matchNeeds a licence key

ThreatFox aggregates IOCs contributed by researchers and sandboxes. A recent entry means the indicator was seen in live malware activity within the last 30 days.

How to fix it: Identify the named malware family and check your telemetry for related indicators. If the infrastructure is yours, treat it as compromised and rebuild; if it is a hosting neighbour, weigh migrating away from the address.

Domain flagged for malware by Google Safe BrowsingNeeds a licence key

Google observed this domain distributing malware: either files served directly, or script that redirects visitors to an exploit kit.

How to fix it: Assume the server is compromised, not merely hosting a bad file. Take it offline, preserve logs before rebuilding, and restore from a known-good backup rather than deleting the file you found. Identify the initial access route, outdated plugin, stolen credential, exposed admin panel, before returning it to service, then request a Search Console review.

Recent threat activity detectedNeeds a licence key

Recent threat activity suggests ongoing malicious operations

How to fix it: Treat as a potential active incident. Review the most recent pulse details to identify the campaign, scan internal logs for matching IOCs (IPs, file hashes, URLs), and trigger your incident-response runbook if any internal asset matches.

High IP abuse riskNeeds a licence key

AbuseIPDB aggregates community reports of malicious IP addresses

How to fix it: If the listed IPs are yours, audit outbound traffic and authentication logs for compromise. Rotate the IPs where possible; for shared/cloud IPs, work with your provider to clean the IP reputation or migrate to a different IP block.

Domain flagged for unwanted software by GoogleNeeds a licence key

Unwanted software includes malware, potentially unwanted programs, and security risks

How to fix it: Open Google Search Console → Security Issues for the affected property to see what content was flagged. Remove the offending scripts, ads, or downloads, then request a review through Search Console: turnaround is typically 24–72 hours.

Domain appears in multiple threat intelligence pulsesNeeds a licence key

Appearing in five or more independent threat-intelligence reports is a pattern, not a coincidence, even without an explicit malicious flag on any single one.

How to fix it: Review the pulses for a common theme: one malware family, one campaign, one hosting range. If they cluster on a shared IP rather than the domain itself, the practical fix is moving to dedicated infrastructure. If they cluster on the domain, investigate what was hosted there historically.

Domain listed in URLhaus malware databaseNeeds a licence key

URLhaus tracks URLs used to distribute malware. This domain appears in it, though the listed URLs are no longer serving content: so this is a historical listing rather than an active one.

How to fix it: Confirm the listed URLs are genuinely gone and that you understand how they got there: a cleaned file with an unpatched vulnerability behind it will simply be re-listed. Once the site is clean and the cause fixed, abuse.ch accepts delisting requests.

Moderate IP abuse activityNeeds a licence key

AbuseIPDB aggregates community reports of malicious IP addresses

How to fix it: If the listed IPs are yours, audit outbound traffic and authentication logs for compromise. Rotate the IPs where possible; for shared/cloud IPs, work with your provider to clean the IP reputation or migrate to a different IP block.

Domain uses TOR exit nodeNeeds a licence key

TOR exit nodes can be used to hide malicious activity behind anonymity

How to fix it: If you do not knowingly run TOR services, audit any infrastructure resolving to TOR-exit IPs: this often indicates DNS misconfiguration or third-party hosting drift. Restrict admin endpoints to non-TOR sources via WAF, geo-blocking, or anonymizer-detection rules where appropriate.

IP previously hosted botnet C2

The IP appears in Feodo Tracker but is no longer marked online. It hosted botnet command-and-control at some point.

How to fix it: Confirm whether the IP was yours at the time of listing. If it was, verify the host was rebuilt rather than just cleaned. If it was a previous tenant, consider requesting a different address, and monitor for lingering blocklist entries.

Domain listed in ThreatFox IOC databaseNeeds a licence key

The domain or one of its IPs is recorded in ThreatFox as an indicator of compromise, though not within the recent window.

How to fix it: Review the associated malware family and confirm the underlying issue was resolved. Where the listing is stale and the infrastructure is clean, request removal via abuse.ch.

Frequent IP abuse reportsNeeds a licence key

Multiple abuse reports from different sources increase credibility

How to fix it: Investigate which behavior triggered the reports (brute-force, scanning, mail abuse). Rate-limit and audit the affected services, file a counter-report or whitelist request with AbuseIPDB if the reports are erroneous, and rotate the IP if reputation cannot be cleared.

Low IP abuse activityNeeds a licence key

AbuseIPDB aggregates community reports of malicious IP addresses

How to fix it: If the listed IPs are yours, audit outbound traffic and authentication logs for compromise. Rotate the IPs where possible; for shared/cloud IPs, work with your provider to clean the IP reputation or migrate to a different IP block.

Domain appears in threat intelligence databaseNeeds a licence key

One or two sightings. Frequently benign: well-known domains appear in pulses simply as examples, and researchers publish indicator lists that sweep up legitimate infrastructure alongside malicious.

How to fix it: Check the pulse to confirm it is incidental: a passing mention, a test domain, or a shared IP. No action is needed if so. Worth a second look only if the pulse describes activity you cannot account for.

Shared hosting IP associated with phishing

One of the IPs serving this domain also serves domains reported for phishing. On shared hosting and large cloud ranges this frequently reflects a neighbouring tenant rather than you, which is why this finding carries reduced confidence and a low weight.

How to fix it: Confirm whether the IP is dedicated to you. If it is, the phishing content is yours to remove. If it is shared, raise it with the hosting provider and consider a dedicated IP for anything that sends mail.

Minimal IP abuse reportsNeeds a licence key

AbuseIPDB aggregates community reports of malicious IP addresses

How to fix it: If the listed IPs are yours, audit outbound traffic and authentication logs for compromise. Rotate the IPs where possible; for shared/cloud IPs, work with your provider to clean the IP reputation or migrate to a different IP block.