Domains carry phishing, host payloads, redirect traffic and serve as command-and-control. The lookup covers reputation, registration and where the domain actually points.
These are format examples. Clicking one puts it in the search box — it does not run a search, so you choose when to spend a lookup.
These are the sections of the report, in the order you will meet them.
The aggregate call and the engines behind it. As with any indicator, read how many sources agree rather than the number alone.
Registrar, creation and expiry dates. Registration age is one of the strongest cheap signals available: a domain registered three days ago and already sending mail deserves suspicion on that basis alone.
How long the domain has existed and how long it has left. Disposable infrastructure tends to be young and short-dated.
What the domain resolves to now -- the A, MX and NS records that tell you where traffic and mail actually go, which is often not what the domain name implies.
The infrastructure behind it, including the JARM fingerprint. A matching JARM across unrelated-looking domains is a strong hint they are the same operator.
The unparsed record, for when the normalised fields have dropped the detail you need. Always there, never summarised away.
AI assistant — can make mistakes. Verify important results.