site:domain - if there are no results, site has been de-indexed.
Or possibly not indexed yet. Complete removal is generally saved for the most serious offenders ("pure spam").
Another big clue is if you don't show up or don't show up first (or at least very close to it) for the site's brand name (assuming it's unique) or in a search for the domain with extension. Even parked pages should show up for this.
Also look to see if any of your pages are cached or if they removed the cache (assuming you are allowing them to be cached in the first place.)
I hate the term "sandboxed". There are two kinds of penalties: manual and algorithmic. Algorithmic penalties (sometimes called "filters") can be minor (just push you down a few notches) or major (like a "-900", where you're still indexed but essentially disappear into oblivion). If you control the site and are running any kind of analytics that can graph data, you can usually figure out what hit you and what triggered it and fix it. You should start seeing a recoverysoon after, or when the algo refreshes (unless the site has a history of long-term deliberate spam, in which case it may be a goner.)
Manual penalties ("manual actions") are always reported in webmaster tools require a reconsideration request to be lifted. Again, success depends on whether it's just a minor offense or the domain has a long history of being a spamfest.
If I'm looking at a domain I'm planning to buy, I look for history (archive.org) and the link profile (ahrefs or majestic) to see if it looks like it looks "clean" or not. I'm especially careful with expired domains with page rank as often they're picked up, spammed to death, and dropped again (or sold). (Not foolproof, bots can be blocked, but most of the time nobody bothers.)