Find Toxic Backlinks Before They Become a Problem
The Malicious Sites report identifies domains flagged as harmful in your backlink profile. It covers both donor domains that link to your site and acceptor domains your site links to. Serpstat's verification algorithm aligns with Google Chrome's safety database and includes data from the German Institute of Information Security.
What you can achieve:
Find toxic inbound links: See every referring domain flagged as harmful so you can evaluate disavow decisions before a manual penalty occurs.
Audit outgoing links: Switch to the acceptor view to check whether your site links out to flagged destinations — a risk often overlooked in standard audits.
Track threats by category: Filter by vulnerability type to understand the nature of risk from each flagged domain — malware, phishing, or social engineering.
Getting Started
Navigate to Backlink Analysis → Malicious Sites in the left sidebar.
Enter a domain (e.g.,
example.com) into the search bar and click Search.The report opens in Malicious donor domains mode by default — these are sites linking to you.
Toggle the switch in the table header to switch to Malicious acceptor domains — sites your domain links out to.
Use the Platform and Vulnerability Type filters to narrow results by threat category.
Click Export to download the list and prepare a disavow file for Google Search Console.
Key Metrics Explained
Donor / Acceptor URL: The malicious domain or page address — source (donor) or destination (acceptor) of the harmful link.
Active backlinks: The number of individual links from that domain to the analyzed site, or vice versa in acceptor mode.
Platform: The operating system for which the detected vulnerability is relevant.
Vulnerability type: The category of risk — for example, malware, phishing, or social engineering.
Last checked: The date when the vulnerability was last confirmed by the security database.
Pro Tip: Prioritize Your Disavow List by Link Volume
Not all toxic backlinks carry equal risk — sort by active link count to focus effort where it matters most.
Sort the Malicious donor domains table by Active Backlinks descending.
Domains with the highest link counts pass the most signal — and the most risk.
Export the top offenders. These are your first disavow candidates.
Submit the disavow file via Google Search Console. Recheck the list monthly using the Last Checked date.
⚠️ Important: Serpstat flags domains using a verification algorithm aligned with Google Chrome's safety database plus data from the German Institute of Information Security. A malicious backlink does not automatically cause a ranking drop — Google typically ignores low-quality links. Disavowal is appropriate when you have documented evidence of harm or a manual action from Google. |
❓ Frequently Asked Questions
Q: What makes a domain "malicious" in Serpstat?
A: Serpstat flags domains that Google Chrome blocks with a safety warning, plus domains reported by the German Institute of Information Security for involvement in legal violations.
Q: Does a malicious backlink automatically harm my rankings?
A: Not always. Google generally ignores low-quality links rather than penalizing for them. However, a large volume of toxic links is a risk signal, particularly during manual reviews. Disavowal is recommended when harm is documented.
Q: Can I filter results by threat type?
A: Yes. Use the Vulnerability Type filter to narrow results to specific categories such as malware, phishing, or social engineering. Use the Platform filter to see risks specific to Windows, Android, or other operating systems.
Next Steps
Referring Domains — See all domains linking to your site with authority scores and referring page counts.
Backlinks — Inspect individual links from flagged domains with full attribute and type data.
Backlink Dashboard — Return to the summary overview of the full backlink profile.