About Web Reputation

Web Reputation tracks the credibility of web domains by assigning a reputation score based on factors such as a website's age, historical location changes and indications of suspicious activities discovered through malware behavior analysis. It will then continue to scan sites and block users from accessing infected ones.

The following table explains the Web Reputation risk levels. View the table to understand why a URL is classified as dangerous, highly suspicious, or suspicious.

Risk Level



The URL is verified to be fraudulent or known sources of threats.

Highly suspicious

The URL is suspected to be fraudulent or possible sources of threats.


The URL is associated with spam or possibly compromised.


The URL has not been tested by Trend Micro. While Trend Micro actively tests webpages for safety, users may encounter untested pages when visiting new or less popular websites. Blocking access to untested pages can improve safety but can also prevent access to safe pages.


The URL contains no malicious software and shows no signs of phishing.

When a user accesses a URL, TMWS:

  • Leverages Web Reputation to verify the credibility of the websites and webpages. Web Reputation assigns reputation scores to web domains and individual pages or links within sites.

  • Allows or blocks users from accessing sites, based on whether the score is below or above the administrator-configured security level.

To increase accuracy and reduce false positives, Trend Micro Web Reputation assigns reputation scores to specific pages or links within sites instead of classifying or blocking entire sites since there are times that only portions of legitimate sites are hacked and reputations can change dynamically over time.

If you believe the reputation of a URL is misclassified or you want to know the reputation of a specific URL, visit the following website: