# Malware & blacklist

Status: live

Malware & blacklist scans each website on a schedule. It checks the domain and the addresses it resolves to against public reputation and safe-browsing lists, then fetches your home page and the pages it links to and records every script they load. Your opening scan sets a baseline. After that you are alerted when a script arrives from a domain the site has never used, when code looks obfuscated or carries crypto-miner signatures, when a hidden iframe appears, or when a third-party script's contents change. Approve the scripts you trust, ignore the noise, and get alerts in the notification bell, webhooks and Workflows.

- **Blocklist checks**: Your domain and server addresses checked against public reputation and safe-browsing lists, with the date each listing started and cleared.
- **Script inventory**: Every script on your key pages recorded with where it loads from and a fingerprint of its contents. Your opening scan becomes your baseline.
- **New script domains**: A script from a domain your site has never loaded before raises an alert until you approve or ignore it.
- **Obfuscation and miners**: Code built from long encoded strings and eval chains, crypto-miner signatures and hidden iframes are flagged with the page they sit on.
- **Changed scripts**: When a third-party script keeps its address but its contents change, you hear about it, since that is how many supply-chain injections start.
- **Alerts and Workflows**: Listings, delistings and suspicious scripts reach the notification bell, signed webhooks and Workflows, on a daily or weekly schedule or whenever you run a scan.