Is this IP or domain worth worrying about?

What gets checked

• Private and reserved ranges: RFC 1918, carrier-grade NAT, loopback, link-local, documentation, multicast and the other IANA special-purpose blocks. This check is offline, and those addresses are never sent anywhere.
• Reverse DNS (PTR), plus a check that the name resolves back to the same IP (forward-confirmed rDNS).
• Registration data via RDAP, the modern replacement for WHOIS: the network owner, the address range, the abuse contact, and a domain's registration date and registry status.
• Domain DNS: A, AAAA, NS and MX records, and public names that point at private addresses.
• Email spoofing protection: whether SPF exists and how strict it is, and the DMARC policy.
• Domain profile (every domain result): registrar, creation and expiry dates and age, registry status flags in plain English, nameservers, whether a website and mail appear to be set up, DNSSEC (DS record and the resolver's validation flag), CAA (which certificate authorities may issue certificates), MTA-STS, TLS-RPT and BIMI records, a one-line summary, and an email security grade (A–F) with the reason for every point. The grade measures spoofing protection, not trustworthiness, and doesn't change the risk score. DKIM isn't graded because it needs the selector from a real message (use Email header mode).
• Email headers (Email header mode): the Received chain (hops, sending IPs, timestamps and delays), From / Reply-To / Return-Path / Sender mismatches, the Message-ID domain, SPF, DKIM, DMARC and ARC results, DKIM alignment with From, display-name spoofing, and look-alike or punycode domains. The sending IPs and domains then go through the same reputation checks.
• QR codes (QR code mode): the code is decoded in your browser and sorted into link, Wi-Fi, phone, text message, email, contact card, map location, crypto payment or plain text. Links are never opened; they are checked as text for shorteners, punycode and look-alike domains, raw or disguised IP addresses, http instead of https, unusual ports, the "user@host" trick, long or encoded query strings, data: and javascript: links, hidden characters and onward-redirect parameters (url=, redirect=, next=…). The link's domain then goes through the same checks as IP / Domain mode. Wi-Fi passwords are hidden until you choose to show them.

How the score works

Each finding adds a fixed number of points: high 35, medium 15, low 5, info 0. The total is capped at 100. 0 means no concerns found, 1–19 minor notes, 20–49 some concern, and 50 or more high concern. Email headers use the same points: under 20 with no high finding is Likely legit, 20–49 or any high finding is Suspicious, and 50 or more (or a DMARC failure plus another high finding) is Likely phishing. Every finding is listed with its reason, so you can disagree with it.

Country is never scored. Attackers rent servers everywhere, and blaming a country punishes ordinary people.

Honest limits

• There is no abuse-database check. Sources like AbuseIPDB, blocklists and threat feeds need API keys or a server, and this site has neither. A clean result here is not a clean reputation.
• No ASN or BGP routing data, no port scans, no malware scanning, and no page screenshots.
• RDAP coverage varies, and some country domains publish nothing. This site's security policy only lets your browser talk to an allowlist of registries (the five regional internet registries plus about 70 of the largest domain registries), so a few smaller or brand TLDs show RDAP lookup unavailable.
• DNS answers come from one resolver at one moment and can change.
• Email mode reads headers only, not the body, links or attachments. It trusts the Authentication-Results your provider added, and the lower Received lines can be forged by the sender. A pass proves which domain sent it, not that the domain is honest.
• QR mode can't see where a link finally lands: a shortener or redirect may lead somewhere else, and that target can change after the code is printed. A sticker over a real QR code looks the same to this check as the real thing.

Use this for triage, then confirm with your own logs and tools. It's defensive only: please don't use it to target anyone.

Privacy

No account, no cookies, no analytics, no trackers, and no server of ours. Your browser sends each lookup straight to the public source below and nothing else gets it. Results stay in this tab until you close it.

• DNS: cloudflare-dns.com (DNS-over-HTTPS)
• Registration: rdap.org, which redirects to the responsible registry (APNIC, ARIN, RIPE, Verisign, and others)

QR code images you drop, paste, choose or photograph are decoded by JavaScript in this tab and never uploaded, stored or added to share links. A link inside the code is never opened or fetched; only its domain name (or IP address) is looked up, the same way as IP / Domain mode. Take photo opens your device's own camera app through the normal file picker, so this site never gets camera access.

Email headers you paste are parsed by JavaScript in this tab and are never uploaded, stored or added to share links. Only the IPs and domains extracted from them are looked up as above.

The site's security policy only lets your browser connect to an allowlist: the DNS resolver, rdap.org, the five regional internet registries and the larger domain registries. If rdap.org redirects a lookup to a registry that isn't on the list, the browser blocks it and the result says RDAP lookup unavailable for this registry; nothing is sent to that registry.

The domain profile uses the same two sources and nothing else: a few extra DNS questions (DS, CAA, and the TXT records at _mta-sts., _smtp._tls. and default._bimi. under the domain) go to the same DNS-over-HTTPS resolver. The MTA-STS policy file and BIMI logo are on the domain's own servers, so they are not fetched.

Those services can see the names and IPs you look up, as with any DNS query. A share link puts your list in the URL, so only share it with people you'd tell anyway.