domain-intel

Passive domain reconnaissance without API keys is performed by utilizing Python's standard library to query public records like Certificate Transparency logs for subdomains and standard DNS protocols for record retrieval.

Yes, you can gather SSL certificate and WHOIS information for multiple domains concurrently. The tool performs bulk analysis, running checks across multiple domains simultaneously to streamline initial security assessments.

To find subdomains using Certificate Transparency logs, the tool queries these public logs to identify historical SSL certificate issuances, which reveal previously registered subdomains for the target domain without needing active scanning.

During a domain reconnaissance assessment, you can retrieve A, AAAA, MX, NS, TXT, and CNAME records. These DNS records help map the target domain's infrastructure and mail routing configuration.

Python's standard library supports WHOIS lookups for over 100 top-level domains (TLDs). This allows you to fetch registration information across a wide variety of domain extensions without external dependencies.

A dependency-free OSINT tool for subdomain discovery relies exclusively on passive signals like Certificate Transparency logs, meaning it will not find subdomains that have never had an SSL certificate issued and avoids active network scanning.