@@ -43,6 +43,13 @@ public class RDAPClient : SingletonBase<RDAPClient>
 
     private readonly HttpClient _client;
 
+    /// <summary>
+    ///     Client for registrar referrals. The URL is sent by the registry and therefore untrusted. Direct connections
+    ///     are only made to the addresses that were checked when connecting (no second DNS lookup, see
+    ///     <see cref="ConnectToPublicAddressAsync" />), which prevents DNS rebinding to local or private addresses.
+    /// </summary>
+    private readonly HttpClient _referralClient;
+
     #endregion
 
     #region Constructor
@@ -59,9 +66,22 @@ public RDAPClient()
             Timeout = Timeout.InfiniteTimeSpan
         };
 
-        _client.DefaultRequestHeaders.UserAgent.ParseAdd("NETworkManager");
-        _client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue(RDAPMediaType));
-        _client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
+        _referralClient = new HttpClient(new SocketsHttpHandler
+        {
+            AllowAutoRedirect = false,
+            AutomaticDecompression = DecompressionMethods.All,
+            ConnectCallback = ConnectToPublicAddressAsync
+        })
+        {
+            Timeout = Timeout.InfiniteTimeSpan
+        };
+
+        foreach (var client in new[] { _client, _referralClient })
+        {
+            client.DefaultRequestHeaders.UserAgent.ParseAdd("NETworkManager");
+            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue(RDAPMediaType));
+            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
+        }
     }
 
     #endregion
@@ -196,13 +216,19 @@ private async Task<RDAPResult> GetAsync(RDAPQuery query, string url, TimeSpan ti
 
             try
             {
-                response = await _client.GetAsync(currentUrl, timeoutSource.Token).ConfigureAwait(false);
+                response = await (isReferral ? _referralClient : _client).GetAsync(currentUrl, timeoutSource.Token)
+                    .ConfigureAwait(false);
                 body = await response.Content.ReadAsStringAsync(timeoutSource.Token).ConfigureAwait(false);
             }
             catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
             {
                 throw;
             }
+            catch (HttpRequestException ex) when (ex.InnerException is RDAPException inner)
+            {
+                // Blocked by ConnectToPublicAddressAsync.
+                throw new RDAPException(inner.Kind, inner.Message, ex) { RequestUrl = currentUrl.AbsoluteUri };
+            }
             catch (Exception ex) when (ex is HttpRequestException or OperationCanceledException)
             {
                 var message = ex is OperationCanceledException ? $"Timeout after {timeout.TotalSeconds} s." : ex.Message;
@@ -261,17 +287,55 @@ private static async Task ValidateReferralTargetAsync(Uri url, CancellationToken
             {
                 addresses = await Dns.GetHostAddressesAsync(url.DnsSafeHost, cancellationToken).ConfigureAwait(false);
             }
-            catch (SocketException)
+            catch (SocketException ex)
             {
-                // The request itself fails with a proper network error.
-                return;
+                // Fail closed: a referral is only followed if its address could be checked.
+                throw new RDAPException(RDAPErrorKind.Network, ex.Message, ex) { RequestUrl = url.AbsoluteUri };
             }
         }
 
         if (addresses.Any(IsLocalOrPrivateAddress))
             throw new RDAPException(RDAPErrorKind.PrivateAddress, url.AbsoluteUri) { RequestUrl = url.AbsoluteUri };
     }
 
+    /// <summary>
+    ///     Connect callback of the referral client: resolves the host once, checks all addresses and connects to exactly
+    ///     these addresses, so a second DNS answer (DNS rebinding) cannot redirect the connection to a local or private
+    ///     address. TLS still validates the certificate against the host name. If a proxy is used, the connection goes to
+    ///     the proxy, which resolves the target itself; in this case the check in
+    ///     <see cref="ValidateReferralTargetAsync" /> applies.
+    /// </summary>
+    private static async ValueTask<Stream> ConnectToPublicAddressAsync(SocketsHttpConnectionContext context,
+        CancellationToken cancellationToken)
+    {
+        var endPoint = context.DnsEndPoint;
+
+        // A tunnel (CONNECT) to the configured proxy. Referrals only use HTTPS, so a proxied connection is always a
+        // tunnel.
+        var isProxy = context.InitialRequestMessage.Method == HttpMethod.Connect;
+
+        var addresses = IPAddress.TryParse(endPoint.Host, out var ipAddress)
+            ? [ipAddress]
+            : await Dns.GetHostAddressesAsync(endPoint.Host, cancellationToken).ConfigureAwait(false);
+
+        if (!isProxy && (addresses.Length == 0 || addresses.Any(IsLocalOrPrivateAddress)))
+            throw new RDAPException(RDAPErrorKind.PrivateAddress, endPoint.Host);
+
+        var socket = new Socket(SocketType.Stream, ProtocolType.Tcp) { NoDelay = true };
+
+        try
+        {
+            await socket.ConnectAsync(addresses, endPoint.Port, cancellationToken).ConfigureAwait(false);
+
+            return new NetworkStream(socket, true);
+        }
+        catch
+        {
+            socket.Dispose();
+            throw;
+        }
+    }
+
     /// <summary>
     ///     Loopback, private (RFC 1918, RFC 4193), shared (RFC 6598), link-local, unspecified and multicast addresses.
     /// </summary>
 
@@ -49,6 +49,34 @@ public static RDAPQueryParseError TryParse(RDAPQueryType type, string input, out
         return query == null ? GetError(type) : RDAPQueryParseError.None;
     }
 
+    /// <summary>
+    ///     Detects the query type of an input without a type (e.g. data redirected from another tool): IP address or
+    ///     CIDR, AS number ("AS15169", "15169", "1.10"), TLD (single label), entity handle (single label with a hyphen,
+    ///     e.g. "ORG-RIEN1-RIPE"), otherwise domain.
+    /// </summary>
+    /// <param name="input">User input.</param>
+    /// <returns>Detected query type.</returns>
+    public static RDAPQueryType DetectType(string input)
+    {
+        input = input?.Trim() ?? string.Empty;
+
+        if (ParseIPAddress(input) != null)
+            return RDAPQueryType.IPAddress;
+
+        // Digits only or with "AS" prefix. Asdot ("1.10") is also numeric, a TLD is never numeric.
+        if (ASNRegex().IsMatch(input))
+            return RDAPQueryType.ASN;
+
+        var label = input.Trim('.');
+
+        if (!label.Contains('.'))
+            return label.Contains('-') && !label.StartsWith("xn--", StringComparison.OrdinalIgnoreCase)
+                ? RDAPQueryType.Entity
+                : RDAPQueryType.TLD;
+
+        return RDAPQueryType.Domain;
+    }
+
     private static RDAPQueryParseError GetError(RDAPQueryType type)
     {
         return type switch
@@ -126,7 +154,9 @@ private static RDAPQuery ParseIPAddress(string input)
         if (parts.Length > 2)
             return null;
 
-        // Zone IDs (e.g. fe80::1%eth0) must not be used in RDAP queries (RFC 9082 3.1.1).
+        // Zone IDs (e.g. fe80::1%eth0) must not be sent in RDAP queries (RFC 9082 3.1.1). They are only meaningful on
+        // the local host and irrelevant for the registration data, so they are removed instead of rejecting the input
+        // (link-local addresses are often copied with a zone ID, e.g. from ipconfig).
         var addressPart = parts[0].Split('%')[0];
 
         // IPAddress.TryParse also accepts shortened IPv4 forms like "1" or "1.2", which are not valid here.
 
@@ -113,9 +113,15 @@ private static void CloseItemAction(ItemActionCallbackArgs<TabablzControl> args)
     ///     Adds a new tab and starts the query, if one is given.
     /// </summary>
     /// <param name="query">Query (e.g. domain, IP address, AS number).</param>
-    /// <param name="queryType">Type of the query. Uses the last selected type if null.</param>
+    /// <param name="queryType">
+    ///     Type of the query. If null, the type is detected from the query (e.g. data redirected from another tool or a
+    ///     run command), or the last selected type is used for an empty tab.
+    /// </param>
     public void AddTab(string query = null, RDAPQueryType? queryType = null)
     {
+        if (queryType == null && !string.IsNullOrWhiteSpace(query))
+            queryType = RDAPQueryParser.DetectType(query);
+
         var tabId = Guid.NewGuid();
 
         TabItems.Add(new DragablzTabItem(query ?? Strings.NewTab, new RDAPView(tabId, query, queryType),
 
@@ -43,6 +43,20 @@
             <Setter Property="CanUserAddRows" Value="False" />
             <Setter Property="SelectionMode" Value="Extended" />
         </Style>
+        <!-- Keyboard accessible link (Tab + Enter), styled like LinkTextBlock -->
+        <Style x:Key="RDAPHyperlink" TargetType="{x:Type Hyperlink}">
+            <Setter Property="Foreground" Value="{DynamicResource MahApps.Brushes.Accent}" />
+            <Setter Property="TextDecorations" Value="{x:Null}" />
+            <Setter Property="Cursor" Value="Hand" />
+            <Style.Triggers>
+                <Trigger Property="IsMouseOver" Value="True">
+                    <Setter Property="Foreground" Value="{DynamicResource MahApps.Brushes.Accent2}" />
+                </Trigger>
+                <Trigger Property="IsKeyboardFocused" Value="True">
+                    <Setter Property="TextDecorations" Value="Underline" />
+                </Trigger>
+            </Style.Triggers>
+        </Style>
         <Style x:Key="RDAPWrapColumnStyle" TargetType="{x:Type TextBlock}">
             <Setter Property="TextWrapping" Value="Wrap" />
         </Style>
@@ -158,15 +172,15 @@
                                     <ItemsControl ItemsSource="{Binding Links}">
                                         <ItemsControl.ItemTemplate>
                                             <DataTemplate DataType="{x:Type viewModels:RDAPLinkItem}">
-                                                <TextBlock Text="{Binding Text}" ToolTip="{Binding Url}"
-                                                           Style="{StaticResource LinkTextBlock}"
+                                                <TextBlock Style="{StaticResource DefaultTextBlock}"
                                                            HorizontalAlignment="Left" TextWrapping="Wrap">
-                                                    <TextBlock.InputBindings>
-                                                        <MouseBinding
-                                                            Command="{Binding Data.OpenUrlCommand, Source={StaticResource BindingProxy}}"
-                                                            CommandParameter="{Binding Url}"
-                                                            MouseAction="LeftClick" />
-                                                    </TextBlock.InputBindings>
+                                                    <Hyperlink
+                                                        Command="{Binding Data.OpenUrlCommand, Source={StaticResource BindingProxy}}"
+                                                        CommandParameter="{Binding Url}"
+                                                        ToolTip="{Binding Url}"
+                                                        Style="{StaticResource RDAPHyperlink}">
+                                                        <Run Text="{Binding Text, Mode=OneWay}" />
+                                                    </Hyperlink>
                                                 </TextBlock>
                                             </DataTemplate>
                                         </ItemsControl.ItemTemplate>