How to Check a Supplier's Official Domain

Before you read a product page, a policy or a lab report, it helps to know whose website you are actually on. Online sellers of peptide products range from established companies to sites that never deliver: in a 2024 study of online semaglutide sellers, none of the three pens the researchers ordered ever arrived, which they attributed to nondelivery scams ^{Source [1]}. This guide covers neutral checks anyone can do. It does not recommend any supplier, and passing these checks says nothing about product quality.

Start from an address you have confirmed

Rather than following a search ad, a social media link or a forwarded message, work from an address you have confirmed in more than one place, such as printed packaging, earlier correspondence you started, or the business's registration records. Then compare the domain character by character. Watch for a swapped letter, an added word such as "official" or "shop", or a different ending, such as .co instead of .com.

Registration data: RDAP and WHOIS

Every domain has registration data. For most generic domains it is now served through RDAP, the Registration Data Access Protocol, which ICANN describes as the replacement for WHOIS. Since 28 January 2025, registries and registrars of generic domains are no longer required to provide WHOIS services, with limited exceptions. ICANN's RDAP page links to its own lookup tool ^{Source [2]}.

Under ICANN's Registration Data Policy, effective 21 August 2025, a lookup must show the domain's registrar, creation date, expiry date, status and the registrar's abuse contact. Personal data such as the registrant's name and street address may be redacted, and redacted fields must be marked as redacted; registrars publish the registrant's country ^{Source [3]}.

What to look at:

• Creation date. A business that claims many years of trading on a domain registered a few weeks ago is a mismatch worth noticing.
• Registrant country. Does it fit where the business says it is based?
• Registrar. The registrar's abuse contact is where problems with a domain can be reported.

Redaction is normal and is not, by itself, a warning sign. It does mean the lookup alone cannot tell you who runs the site.

Certificate details: what the padlock means

Clicking the padlock in your browser shows the site's TLS certificate: which domain names it covers, which authority issued it and when it expires. A padlock or https means the connection is encrypted, and a valid certificate means a certificate authority took steps to verify that the address belongs to the organization using it; how strictly authorities check varies ^{Source [4]}. Some certificates are domain-validated only. Let's Encrypt, for example, issues only domain-validation certificates, which confirm control of the domain, not who runs the business ^{Source [5]}. The FTC also warns that https in an address does not mean a site is legitimate ^{Source [6]}.

Issued certificates are also recorded in public Certificate Transparency logs, which anyone can query to see which certificates were issued and when ^{Source [7]}. That lets you see when certificates for a domain first appeared.

Business registration

US companies formed as LLCs or corporations generally register in each state where they do business, usually through the Secretary of State's office or a similar agency ^{Source [8]}. These records can often be searched online; Delaware's Division of Corporations, for example, offers a business-entity search and an entity status check ^{Source [9]}.

Check that the legal name in the website footer, terms, return policy and invoices matches a registered entity, that the entity's status is active, and that the addresses are consistent. A trading name with no legal entity anywhere on the site is a gap, not proof of fraud, but it limits what you can verify.

Match the domain across documents

Compare the domain and company name across everything you see or receive: the website, order confirmations, invoices, the return policy and any certificate of analysis. FDA's GMP guidance for drug ingredients expects a certificate of analysis to give the name, address and telephone number of the manufacturer or of the laboratory that performed the analysis ^{Source [10]}. If a report matters to you, contact the named laboratory through details you find independently, not through a link or number printed on the report, and ask whether it issued that report. A document naming a different company, or using an email domain that differs from the website by a character, is a reason to stop and check. Our guide to what a certificate of analysis can and cannot tell you covers the rest of the document.

Complaints and scam warning signs

The FTC suggests searching for the company name together with words such as "complaint" or "scam". It also warns that sellers who insist on payment by gift card, wire transfer, payment app or cryptocurrency are showing a red flag, because money sent those ways is hard to recover ^{Source [6]}.

What these checks cannot tell you

A consistent domain, a valid certificate and an active business registration tell you who you are dealing with. They do not tell you whether products match their documents, whether they may legally be sold for a given purpose, or whether they are suitable for any use.

Research materials and consumer products belong to different categories. A listing, laboratory report, or research-use label does not establish suitability for personal use. For how we approach suppliers and products, see how we evaluate products and suppliers.