Website Recon Guide

What the standard scan does

• Accepts a domain, hostname, or full URL and normalizes it to a hostname.
• Reads the registration from the registry’s own RDAP server: registrar, dates, lifecycle state, transfer, update and delete locks, and name servers.
• Identifies the web host, CDN and DNS provider from DNS answers and network data, matched against our provider catalog.
• Lists who to report abuse to, each in its own role: host, CDN, network operator, registrar, registry and the site owner’s security.txt contact.
• Opens the homepage the way a browser would and reports where it lands, every redirect, the page title, password forms and forms that send what visitors type to another site, cookie consent, policy links and trackers with their account IDs.
• Warns when the domain or page title borrows a well-known brand the domain does not belong to, such as a PayPal login on an unrelated domain, or a name spelled with look-alike characters.
• Checks the domain against URLhaus and the domain blocklists mail filters use (SURBL and URIBL, and Spamhaus DBL where it is set up).
• Adds the current TLS certificate, links to public investigation services, and a copyable case summary.

After each scan, a remote browser opens the site and the screenshot appears at the top of the report, next to the verdict and key facts, so you can see what visitors see without visiting it yourself. Screenshots are kept for an hour and count toward a daily limit; when the limit is reached, the report says so and you can try again later.

The homepage is read from its source without running scripts, so a cookie banner or tracker added by JavaScript, or a phishing page that shows bots something different, may not appear.

Email, DNS and TLS security are graded in Security Posture; each report links there once, through its security grade. To read the DNS records themselves, use Domain Visualizer.

Who to report to

The Report Abuse panel lists every party that can act on a domain, with the contact each one publishes and what it can do:

Registrar and registry contacts come from the registration record and handle complaints about the registration itself. Hosting contacts handle the website. Each is labelled with its role so a report reaches the party that can act on it.

Choose what you are reporting (phishing, malware, a hacked or defaced site, or other abuse), then select Write report next to a party. It drafts a subject and message for that party with the evidence from the scan: the URL and redirects, page title, password forms, any impersonated brand, IP addresses and network, registrar and registration date, and blocklist listings. Where our provider catalog has a party’s preferred format, the draft uses it. Copy the text into your own email or the party’s report form; nothing is sent from the page. Add what you observed before sending.

Evidence and caveats

Website Recon is designed to show both why it thinks a provider match is plausible and why that match may still be incomplete. The evidence list supports the claim; the caveats list limits it.

If a CDN is detected, Website Recon stops at that CDN by default and warns that the origin may be hidden. That warning is deliberate. It prevents the product from presenting a CDN-adjacent guess as if it were a confirmed origin attribution.

Input normalization and results flow

The landing form accepts a plain domain, a hostname, or a full URL. Internally, the flow normalizes what you entered to a hostname before running the scan, then opens the results page.

This means the safest way to compare runs is to think in terms of hostnames, even if different users paste different full URLs that resolve to the same host.

Recon Advanced (paid plan)

Recon Advanced is part of the paid plan. On top of the Standard report it adds Certificate History from public Certificate Transparency logs: a bounded summary of the certificates crt.sh returns for the domain and its subdomains, with issuers, dates and the most recent certificates. Coverage can be incomplete because of indexing gaps, response-size limits or a failed lookup, so a missing certificate is not proof that none was issued. Subdomain discovery lives in Domain Visualizer Advanced.

Advanced results are never served from cache.