This runs for real — DNS, registration records and TLS certificate, live, right now. It's one of the checks that runs on every case. Most scam infrastructure is under a month old, and you'll see that immediately.
We resolve the domain and read public registration data. We don't open the page — loading hostile content from our own demo would be a poor trade for a feature this doesn't need.