How to use ThreatDNS
ThreatDNS checks a domain, IP address or email address against more than ten security sources at once and gives one verdict you can act on. It’s free, and you don’t need an account. It’s built by the team behind DNSAFE.
Check something
- Domains:
example.com, or a full link; we take the domain from it. - IP addresses: public IPv4 or IPv6. Private addresses (like 192.168.x.x) can’t be checked.
- Email addresses: checks the sender’s domain and whether the address appears in known data breaches.
- Defanged links work:
example[.]comandhxxps://are cleaned up for you, and so is a whole log line pasted in. - Shortcuts: press
/to jump to the search box. Drag the Check on ThreatDNS bookmarklet from the home page to your bookmarks bar, then click it on any site to check that site.
Read a report
The verdict at the top comes from every source together, as a score from 0 to 100. The reasons under it say exactly which signals counted.
What counts
- 3 or more VirusTotal engines flagging it (5 or more counts more)
- Google Safe Browsing or Spamhaus listing it
- High abuse confidence on AbuseIPDB, or a Tor exit node
- Threat tags from Netlas
- The DNSAFE threat list (the card names the feed that listed it)
- A domain registered less than 30 days ago
What doesn’t count on its own
- 1–2 VirusTotal detections. Out of about 90 engines, a couple of hits is usually a false positive.
- Open ports. Remote Desktop or SSH open on an IP is exposure worth fixing, not proof the IP is malicious. We mention it only when something else already looks off.
The cards
| Card | What it tells you |
|---|---|
| DNSAFE | Whether DNSAFE blocks it, and which threat feed listed it |
| VirusTotal | How many of ~90 antivirus and URL engines flag it |
| Google Safe Browsing | Whether Google lists it for malware, phishing or unwanted software |
| Spamhaus | Whether it’s on Spamhaus blocklists |
| URLScan | Recent public scans of the site, with screenshots |
| Registration | When the domain was registered, by whom, and when it expires |
| Certificates | Certificates issued for it, and subdomains they reveal |
| DNS | Live records, and whether it has SPF and DMARC (email spoofing protection) |
| AbuseIPDB | Abuse reports and confidence for an IP |
| IPinfo | Where an IP is, who runs the network, hosting or home connection |
| Netlas | Open ports and services on an IP, threat tags, and how many domains point at it |
Click any IP, name server or mail server in a report to check it next. A card that says a source is busy or unavailable just means that source didn’t answer this time; the verdict uses the rest.
Email checks
There are two separate questions: is the sender’s domain dangerous (that decides the verdict), and has the address leaked in a data breach? Being in a breach doesn’t make an address unsafe. It usually means a company it was registered with was breached, so change any reused password and turn on two-step sign-in.
Email checks have their own daily limit and are never put in the address bar or in share links, to protect people’s privacy.
Share a report
- Copy link: domain and IP reports have their own address, like
threatdns.com/domain/example.com. - Copy summary: a plain-text summary for a ticket, email or chat.
- Ask for a second opinion in r/threatdns. Write the domain defanged (
example[.]com) so nobody clicks it by accident.
Sign in & limits
| Who | Checks a day | Email checks a day | AI analyst |
|---|---|---|---|
| No account | 3 | 3 | – |
| Free DNSAFE account | 10 | 10 | – |
| DNSAFE Personal or Family | 50 | 25 | – |
| DNSAFE Pro, business or MSP | Unlimited (fair use: 60 an hour, 500 a day) | 25 | Included |
“Sign in with DNSAFE” uses your DNSAFE account; there’s no separate ThreatDNS login. Opening ThreatDNS from the DNSAFE portal signs you in automatically. Limits reset at midnight UTC. More on the Pricing page.
AI analyst
On DNSAFE Pro, business and MSP plans, the analyst writes a plain-English summary of the report and answers follow-up questions about it (up to 30 a day). It only uses the data in the report, and it can be wrong, so treat it as a second pair of eyes.
The API
The same checks and verdict from your own scripts and tools, free during the beta: 500 checks a month (1,000 with Pro or a business or MSP plan) and bulk checks of up to 100. Domains and IPs only. API docs →
Wrong results
If something safe looks dangerous, or something dangerous looks clean, report it or post it (defanged) in r/threatdns. If DNSAFE blocks a site you need, the account owner can add an Allow rule straight away in their DNSAFE dashboard.
Privacy
No ads, no trackers, no selling data. Results are cached for up to 24 hours by the thing checked, not by who checked it, and your recent checks list lives only in your browser. Details are in the Privacy Policy.