domain_provenance
Who runs this domain? Live RDAP lookup: registration date and age, registrar, nameservers, status, whether the registrant is redacted, plus a typosquat check (edit-distance / brand-substring) against high-value brands. A very recently registered domain resembling a bank or big brand is a classic phishing signal — but report it as a signal, not a conclusion.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | e.g. example.com |