Help

What the fields mean.

Every label on a result page that has a ? next to it opens a short explanation. They are all collected here.

This page

Overview: The headline facts about what you looked up: who holds it, when it was registered, when it expires, or which network owns it.Start here; the sections below go into detail.
Lookup details: Which sources answered this lookup, how long each took, and which generation of each local dataset was used.Useful when two sources disagree or a result looks stale.
Copy JSON: Copies the complete structured result of this lookup, the same data the API returns.

Domain

Registrar: The company the domain was registered through.It is who to ask about renewals, transfers and the abuse contact.
IANA ID: A number IANA assigns to every ICANN-accredited registrar.It stays the same when a registrar changes its name, so it identifies the company reliably.
Accreditation: The registrar's status in the IANA registrar-ID list: accredited, terminated or reserved.A terminated registrar can no longer sell new gTLD domains.
Popularity: The domain's rank in the Tranco top-1M list, which combines several public popularity lists.No rank means outside the top million, not that the site is unused.
Hints: Plain labels such as parked, URL shortener, dynamic DNS or disposable mail, matched against public MISP warning-lists.Context, not a verdict.
TLD: The last label of the name (.com, .de). The registry that runs it decides the rules and which RDAP / WHOIS server answers.
Expires: When the registration lapses unless it is renewed.After that there is usually a grace period before the name is released for anyone to register.
Created: The date the name was first registered.
Updated: The last time the registry changed this record.For a domain that includes renewals and name-server or status changes.
DNSSEC: Whether the domain's DNS answers are cryptographically signed so a resolver can detect forged ones.Signed does not mean safe content, only that DNS answers were not tampered with on the way.
Abuse: The contact for reporting spam, phishing or malware, published by the registrar or the network operator.
Registry ID: The registry's own identifier of this domain record.Handy when you talk to the registrar or the registry about it.
Status: Flags set by the registry or the registrar, for example clientTransferProhibited (the domain cannot be transferred away).Hover a value for its meaning.
Nameservers: The servers that answer DNS for this domain.Changing them moves where the domain's records are served from.
Availability: Whether the name can be registered: taken, available, or unknown when this instance cannot tell.Available here means no registration was found, confirm with a registrar before relying on it.

DNS

DNS: The records published in the domain's DNS zone, read from resolvers when you asked.
DNSSEC validation: How much of the DNSSEC chain was found: secure (a validating resolver confirmed the answers), signed (a DS record is in the parent zone), keys (DNSKEY only, no DS) or insecure (none).
A: Maps a name to an IPv4 address.
AAAA: Maps a name to an IPv6 address.
MX: The mail servers that accept email for the domain; the number is their priority, lower is tried first.
NS: The name servers that are authoritative for the domain.
TXT: Free-form text records. Often used for email policy (SPF, DMARC) and to prove ownership to a service.
CNAME: An alias: this name is the same as another name.
CAA: Lists which certificate authorities may issue TLS certificates for the domain.
SOA: The zone's start-of-authority record: primary name server, contact, serial number and refresh timers.
Reverse DNS: The name an IP address points back to (a PTR record).Mail servers often check that it matches the forward name.
Services: Third-party services inferred from the DNS records: mail providers, CDNs, verification tokens.Inferred from records only, not confirmed by connecting to anything.
Possibly dangling records: DNS records that point at a service or host that may no longer be claimed.An unclaimed target can sometimes be taken over by someone else. A lead to verify, not a confirmed takeover.
Zone health: Checks that the domain's delegation is consistent: name servers agree, glue records match, no server is lame.Findings are hints to verify, not verdicts.

Mail

Mail security: What the domain publishes in DNS to protect its email: SPF, DMARC, MTA-STS, TLS-RPT, DANE and BIMI.Read from DNS only. Nothing connects to the mail servers.
SPF: Lists the servers allowed to send mail for the domain.
DMARC: Tells receivers what to do with mail that fails SPF or DKIM: nothing, quarantine or reject.p=none only monitors; spoofed mail is still delivered.
MTA STS: A policy that asks other mail servers to use TLS when delivering to this domain.
TLS RPT: An address that receives reports about failed TLS delivery attempts to the domain.
DANE: Publishes the mail server's TLS certificate fingerprint in signed DNS.
BIMI: Lets a domain show its logo next to authenticated mail in supporting mail clients.
DKIM: A signature on outgoing mail that receivers verify with a public key published in DNS.

Network

RPKI: Whether the route announcement is covered by a signed ROA authorising the origin AS: valid, invalid or not found.Checked against a local VRP file, no live validation.
Origin AS: The autonomous system that announces this prefix on the internet.
ASN: Autonomous system number: the identifier of a network that routes its own address space on the internet.
RIR status: How the registry lists the block, for example allocated or assigned.
Max length: The longest prefix a ROA authorises the origin AS to announce.
RIR block: The address block as delegated by a regional internet registry (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC).
Registry: The regional internet registry that delegated this block.
Registry country: The country recorded by the registry for the delegation, not where the host is.
Allocated: The date the registry delegated the block.
Prefix: An address block written as address/length, for example 203.0.113.0/24.
Range: The first and last address of the block.
Network: The network record from RDAP: its name, handle and type.
Handle: The registry's identifier for the network or the autonomous system.
Organization: The organisation the registry lists as holder.
Contacts: People and roles from the registry record: abuse, technical, administrative. Duplicates are merged.
Cloud: Whether the address lies in a range published by a cloud or CDN provider such as AWS, Google Cloud, Azure or Cloudflare.It says who runs the address block, not who the customer is.
Anonymizer: The address is a known Tor exit node or an iCloud Private Relay egress address.Traffic from it may come from many different users.
Known as: A well-known role of the address from public lists: a public DNS resolver, a sinkhole, an internet scanner.
GeoIP: An approximate location from a local MaxMind GeoLite database.Accurate at country level at best; the location of an address is not the location of its user.

Reputation

Reputation: Whether the name or address appears in block lists downloaded to this instance (Spamhaus DROP, FireHOL, URLhaus, PhishTank).Local dumps only, nothing is queried live. Being listed is a signal, not a verdict.
Verdict: Unknown means no listing was found; observed means it is listed; high risk means several strong listings.
Evidence score: A 0 to 100 sum of the severity of each listing (high 40, medium 20, other 10), capped at 100.A way to rank evidence, not a probability.
Count: How many identical listings were folded into one entry, for example many URLs on the same host.

Web3

Web3: Details of a blockchain name (ENS, Unstoppable, SPACE ID, Handshake, Solana names) read from the chain.
Namespace: The naming system the name belongs to, for example ENS for .eth.
Chain: The blockchain the name's registry lives on, with its chain ID.
RPC: Which kind of endpoint this instance used to read the chain. Operator means the endpoint its operator configured.
Owner: The address that holds the name. For tokenised names it is the NFT holder.
Name account: The on-chain account that stores the name's record (Solana names).
Registration: The term of an ENS .eth registration: active, in its grace period or expired and released.During grace the owner can still renew; after it the name can be registered by anyone.
Namehash: The 32-byte hash that ENS-style name services use on-chain instead of the readable name.Needed when you look the name up in a contract or explorer.
Resolver: The contract that stores the name's records: addresses, text records, content.
CCIP Read: An ENS mechanism (EIP-3668) that lets a resolver fetch records off-chain. It says whether it was used and whether the answer was verified.
Records: What the name points to: wallet addresses, a content hash and text records such as a website or social handles.
On-chain details: Technical facts about where and how the name is stored: namespace, chain, resolver and namehash.
Addresses: Wallet addresses the name points to, by network.
Content: A content hash pointing at decentralised content such as an IPFS site.