domain-intel

Subdomain discovery and DNS record checks retrieve passive OSINT signals from Certificate Transparency logs and resolve A, AAAA, MX, NS, TXT, and CNAME records into normalized JSON output for security research and domain due diligence.

Bulk WHOIS lookup and TLS certificate inspection support parallel execution across multiple domains, querying TCP port 43 for registration metadata and TCP port 443 for SSL expiry, issuer, subject, SANs, TLS version, and cipher details.

Passive OSINT domain reconnaissance gathers infrastructure signals like subdomains, DNS records, WHOIS data, and TLS certificates without active scanning, needed for pre-registration checks, brand due diligence, and security investigation.

No API keys are required to retrieve WHOIS registration metadata or TLS certificate attributes, as the task uses Python stdlib for network resolution, direct TCP port 43 WHOIS lookups, and TCP port 443 SSL inspection.

A domain availability heuristic estimates registration status by combining DNS resolution results, WHOIS presence data, and TLS reachability on port 443 to determine if a domain is active or potentially unregistered.

Subdomain discovery via Certificate Transparency logs relies on crt.sh HTTPS queries, limiting results to subdomains with issued TLS certificates and missing subdomains that have never been part of a certificate request.