domain-intel

Query Certificate Transparency logs via crt.sh, which passively lists subdomains from issued certificates. The subdomains command fetches this data over HTTPS and filters out expired certificates, returning up to 200 unique names.

Connect to the host on port 443 with Python's ssl module and parse the certificate's notAfter field. The ssl command reports days remaining, expiry status, TLS version, cipher suite, issuer, and subject alternative names as JSON.

Yes, the tool uses only Python standard library modules like socket, ssl, and urllib, so it runs identically on Linux, macOS, and Windows with no dependencies. WHOIS queries use TCP port 43, which some restrictive networks may block.

Many WHOIS servers redact registrant details due to GDPR privacy regulations. The lookup still returns registrar, creation and expiration dates, name servers, and domain status when available.

No, it is a heuristic combining three passive signals: DNS records, WHOIS responses, and SSL reachability. It returns a verdict with a confidence level, but only a registrar API can confirm availability authoritatively.

Use web search or content extraction for learning what a company does or reading page content. Use passive domain reconnaissance only for infrastructure questions like subdomains, certificate expiry, DNS records, and registration data.