Website Security Audit — IP & Domain Threat Brief

A full website audit spans TLS configuration, security headers, content security policy, authentication flows, and application vulnerabilities. This tool covers threat intelligence signals available from public DNS and reputation data — phishing hostname patterns, domain and IP blocklists, fraud scoring, and email authentication presence.

Pair audit results with security-headers-checker, ssl-tls-grade-checker, and website-vulnerability-scanner on the hosting IP for layered posture documentation.

Domain path returns phishing object from hostname heuristics — riskScore, riskLevel, signals. dnsbl array shows DBL URIBL ZRD listing status. resolvedIp captures first IPv4 A record when present. ipThreat embeds malware IP checker output for that IPv4 including malwareListHits and infrastructure flags.

emailAuth summarizes SPF and DMARC presence from live DNS — authentication gaps compound distrust on already suspicious hostnames.

IP path merges handleReputation output — fraudScore, detections for DNSBL VPN proxy hosting botnet, blacklist list detail — with handleSpamhaus per-zone results. summary synthesizes fraud score and Spamhaus listed status in one sentence for ticket titles.

Use malware-ip-checker afterward when you need malwareListHits emphasis without fraud score noise.

Run before marketing campaigns on new tracking domains, after phishing reports targeting your brand, and when onboarding third-party SaaS portals. Archive brief JSON with change tickets for compliance evidence.

Recheck during active incidents — threat actors rotate infrastructure within hours.

High phishing riskScore combined with DNSBL listing strongly suggests active campaign infrastructure. Medium phishing with clean DNSBL may indicate reconnaissance registration not yet used. Low phishing with DNSBL hit may reflect compromised legitimate site.

Document signal combinations in audit reports rather than relying on summary alone.

When website domain resolves to IPv4, ipThreat adds malware-oriented DNSBL and hosting context for hosting IP. CDN domains may show edge IP threat data unrelated to origin abuse.

Cross-check origin IP via origin-ip-finder when CDN obscures resolution when accurate ipThreat matters for takedown.

Both pages call action threat-intel with identical JSON. threat-intelligence-lookup uses threat intelligence SEO vocabulary; website-security-audit targets operators searching website security audit workflows from launch checklists and vendor questionnaires.

API consumers use threat-intel with query, ip, or domain parameters interchangeably.

No CSP, HSTS, or X-Frame-Options grading — use security-headers-checker. No Shodan vulns — use website-vulnerability-scanner on hosting IP. No page content malware scan — use malware-url-scanner on full URLs.

Treat this brief as threat signal layer one in a multi-tool audit pipeline.

GET /ip-tools/api/extended?action=threat-intel&query=example.com or query=8.8.8.8. Parse type, summary, and nested objects. Branch on type domain versus ip in automation logic.

Rate limits apply — cache results briefly during batch vendor audits.

Website security audits on third-party indicators must align with organizational policy and law. Query only domains and IPs you own or are authorized to assess.

Do not use aggregated briefs for discriminatory profiling or automated punishment without review.