Website Recon technical details

Scan pipeline

1. Input normalization: A domain, hostname or full URL is accepted. Internationalized names can be entered in Unicode; they are scanned in their ASCII (Punycode) form, both forms are shown, and labels that mix scripts or use characters that look like ASCII letters are flagged for review. URLs are parsed and reduced to their hostname, ports and paths are dropped, and inputs that are not a public hostname are rejected with an explanation.
2. DNS resolution: A, AAAA, CNAME, NS and MX records are resolved over DNS-over-HTTPS, and the CNAME chain is followed. Mail security records are left to Domain Visualizer.
3. Parallel enrichment: Each resolved IP is looked up in RDAP to find its network owner, and its origin AS number comes from BGP routing data through Team Cymru's IP-to-ASN DNS service, the domain is looked up in RDAP (registry endpoint from the IANA bootstrap file, with rdap.org only as a fallback) for the registrar, registry data source, dates, delegated name servers, abuse contacts and every published status, which is explained in plain language and grouped into lifecycle state, transfer protection and update or delete restrictions, and certificate history, URLhaus listing status, Abusix abuse contacts and security.txt are fetched at the same time. The registered domain is also looked up in the SURBL and URIBL domain blocklists over DNS, and in Spamhaus DBL through its Data Query Service where a key is configured. These lists refuse many queries from public resolvers and answer with a special code; that code is reported as “unavailable”, never as clean or listed.
4. Homepage: The homepage is requested over https (falling back to http) with a browser-like user agent. Up to five redirects are followed one at a time and recorded; a redirect to an IP address or a private name is recorded but not followed. Up to 600 KB of the page is read, without running scripts, for the title, generator, a meta refresh target, consent platforms or a cookie banner, privacy, cookie and terms links, analytics and ad trackers with their account IDs, and forms, including password fields and forms that post to another site or over plain http.
5. Technologies: The homepage’s response headers (such as Server, X-Powered-By and CDN request IDs), the names of the cookies it sets, its generator tag and its page source are matched against known signatures to name the web server, language, framework, CMS, store or site builder, JavaScript libraries, CDN, firewall and host, with a version where one is shown. Each entry says where it was seen. A PHP version past its end of security support is flagged. The check makes no requests of its own; cookie values are never kept, only their names.
6. Brand impersonation: The domain name, its look-alike spellings (digits for letters, and Unicode letters that read as Latin ones) and the page title are compared against a list of brands that phishing often borrows. A brand found on a domain it does not own is flagged; it is rated likely when the page asks for a password or the name uses look-alike characters, and possible otherwise. The check uses data the scan already has and makes no requests.
7. Provider attribution: Evidence is scored against the provider catalog to pick the most likely DNS, CDN and hosting providers.
8. Abuse and caveats: Abuse contacts are assembled from the matched providers, RDAP entities and Abusix, and caveats are attached that explain where the attribution may be incomplete.

How providers are matched

• CNAME suffix: A CNAME in the chain that ends in a known provider domain. High-priority patterns add 0.34 and others add 0.18.
• NS suffix: Authoritative name servers that belong to a provider. These add 0.30 or 0.15.
• ASN: A resolved IP that sits in a provider's autonomous system. This adds 0.38, the strongest single signal.
• Organization name: The network owner name in RDAP mentions the provider. This adds 0.20.
• IP literal: A resolved IP that matches a known provider address. This adds 0.26.

Each provider starts from its catalog base confidence, and the total is capped between 0 and 1. A provider is only shown for a role (DNS, CDN or hosting) when it reaches at least 0.35 and has at least one piece of evidence. The overall confidence, reported under Technical details, is the highest surfaced score, or 0.18 when nothing qualifies.

Registration tracking

Accounts with registration tracking can track a domain from its results. Its RDAP record is then checked once a day. A new snapshot of the registrar, statuses, registry and registrar expiration dates, creation, update and transfer dates and name servers is stored only when something changes, and each change is shown as a window between the two checks that bracket it. A failed lookup is retried later and is never recorded as a removal. Scans without tracking create no registration history, but their results are cached as described above.

Risk signals

• Registration age: Domains under 7 days old are flagged high, under 30 days medium, and under 90 days low.
• Registry status: A hold status is flagged high and pendingDelete medium.
• Top-level domain: TLDs on the high-risk list are flagged medium.
• Short-TTL address pool: More than two IPs with a minimum TTL under 300 seconds is shown as an observation, not a risk signal. CDNs and load balancers routinely match it. Fast flux would need evidence one scan cannot give: addresses that keep changing over time across many unrelated networks, usually with a very young domain.

Why a CDN limits attribution

When a CDN is detected but no hosting provider is, the result is marked as limited. The visible IPs belong to the CDN edge, so the true origin is hidden, and reports should normally go to the CDN, which can forward them to its customer. When no provider reaches the threshold, the summary says attribution signals were limited rather than guessing.

Caching and limits

• Cache: Standard scans are cached per hostname for 6 hours by default (an admin setting). Advanced scans are never served from cache.
• Rate limits: By default, anonymous visitors can run 20 scans an hour, signed-in users 60, and Advanced scans 5. The daily limit is four times the hourly one for Standard scans.
• Advanced: Advanced mode needs the paid plan by default (an admin setting can open it to everyone or to free accounts). Without access the API answers 402 with a link to the account page instead of running the scan. Advanced adds one crt.sh query for %.domain, within the scan's outbound request budget.

Analyst notes

Recon results are best-effort. Confirm the provider and the abuse contact against the evidence listed with each match before you file a report, and include that evidence in the report, because many providers ask for it before acting.