Domain age & risk checker
Check any domain's registration age, registrar, mail configuration and fraud risk. Paste a domain or a full URL. No signup.
Same check from your code
The API returns everything above plus homograph detection for lookalike domains, and the domain's SPF and DMARC posture.
curl "https://www.layercall.com/v1/score/domain?domain=example.com" \
-H "x-api-key: YOUR_KEY"1,000 lookups a month free, no card. Get a key or read the docs.
What each signal means
Newly registered
The domain was registered recently — typically within the last 30 days.
The strongest single signal in domain risk. Phishing and scam infrastructure is disposable by design, so it is almost always young. Legitimate businesses accumulate domain age; fraud campaigns cannot.
Resolves
The domain has DNS records and points somewhere.
A domain that resolves to nothing is either parked, expired, or was typed wrong. On a signup form it usually means a typo; in a link it often means the campaign is already over.
Accepts mail
MX records are published, so the domain can receive email.
A corporate email address on a domain with no MX cannot be real. This catches invented company domains that look plausible at a glance.
Risky TLD
The top-level domain is one disproportionately used for abuse — often the free or near-free ones.
A weak signal alone, and unfair in isolation since legitimate projects use cheap TLDs too. It becomes meaningful stacked with youth and missing infrastructure.
Questions
Why does domain age matter for fraud detection?
Fraud infrastructure is disposable. Phishing sites, fake shops and scam campaigns are taken down or abandoned within weeks, so operators register fresh domains constantly. A domain registered three days ago behaves very differently from one registered in 2015, and age is one of the few signals an attacker cannot fake — only wait out.
Where does the registration date come from?
RDAP, ICANN's official successor to WHOIS. It is authoritative and free, which means the date is accurate rather than estimated. Some TLDs publish less than others, so a small number of domains return no date at all.
Should I block domains registered recently?
Not outright — every legitimate business had a new domain once. Use it as a weighting: young plus no MX plus a risky TLD plus a disposable pattern is a very different picture from young on its own. That is what the combined risk score expresses.
What is a homograph or lookalike domain?
A domain that reads as a legitimate one but is not — Cyrillic characters standing in for Latin, or fullwidth spellings that fold onto a real ASCII name. They are used to make phishing links survive a human glance. Detection is available with an API key.
Can I check a full URL instead of a domain?
Yes. Paste a URL and the tool strips the scheme and path for you before checking the domain.