TECHNICAL
RDAP Explained: How to Read a Domain Registration Record
RDAP, the Registration Data Access Protocol, is the standard HTTPS service through which a registry returns a domain's registration record as structured JSON.
12 min readDomain intelligence
Every conclusion about a domain rests on a public record. These guides explain what each source returns, how to read it, and where it stays silent.
START WITH RDAP EXPLAINED: HOW TO READ A DOMAIN REGISTRATION RECORD
TECHNICAL
WHOIS vs RDAP: What Changed, and What Still Uses WHOIS
WHOIS is the original port 43 text protocol for querying registration data; RDAP is the structured HTTPS and JSON replacement that generic top-level domain registries and registrars were required to adopt.
10 min readTECHNICAL
What DNS Records Reveal About a Lookalike Domain: A, MX, NS
DNS records are the published answers a domain gives about where it lives, how it receives mail, and who is authoritative for it, and on a lookalike domain each one is a piece of evidence about preparation.
11 min readTECHNICAL
Certificate Transparency Logs: Catch Lookalike Domains Early
Certificate transparency is a system of public, append-only logs recording certificates as they are issued, so that any certificate for any name can be discovered by anyone.
10 min readFIELD GUIDE
How to Investigate a Suspicious Domain Without Visiting It
Investigating a suspicious domain without visiting it means establishing what it is from public registration, DNS, certificate and passive records, without sending a request to the site itself.
10 min readMore sections: Typosquatting, Domain protection, Brand protection, Email security, Typosquatting patterns.