I know it's GeoIP for the IP location, but how is it telling the server type?

It just does a HTTP "GET /" request to that domain's webserver and looks into the response header, e.g what you get with a HEAD request:

perl -e 'use LWP::UserAgent; print LWP::UserAgent->new()->head("http:/
+/cosmicperl.com")->headers()->as_string'
Connection: close
Date: Mon, 11 Jun 2007 02:53:48 GMT
Accept-Ranges: bytes
Server: Apache/2.0.54 (Fedora)
Vary: Accept-Encoding
Content-Type: text/html; charset=ISO-8859-1
Client-Date: Mon, 11 Jun 2007 04:23:12 GMT
Client-Peer: 213.133.65.182:80
Client-Response-Num: 1
[download]

More information is available if you exchange the head() with get() in the above one-liner. For the cert, it sends a HTTPS request and looks into what certificate is being sent; then the scripts asks some RBL database, etc.

And forgive me for being stupid but right now I can't remember how to get an IP from a domain name

perl -MSocket -le 'print inet_ntoa(inet_aton("cosmicperl.com"))'
213.133.65.182
[download]

_($_=" "x(1<<5)."?\n".q·/)Oo.  G°\        /
                              /\_¯/(q    /
----------------------------  \__(m.====·.(_("always off the crowd"))."·
");sub _{s./.($e="'Itrs `mnsgdq Gdbj O`qkdq")=~y/"-y/#-z/;$e.e && print}