Domain Intel

• You need to enumerate subdomains of a target domain passively via Certificate Transparency logs
• You want to inspect TLS certificate details such as expiry date, issuer, or Subject Alternative Names
• You need WHOIS registration data — registrar, creation/expiry dates, name servers — across any TLD
• You want to check whether a domain is registered or available, or run these checks in bulk across many domains at once

• You want to know what a company or website does — use web_search or web_extract for content-level research
• You need authoritative domain availability confirmation for purchase — the availability check is heuristic-based, not registrar-level
• You are on a network that blocks outbound TCP port 43 — WHOIS lookups will fail in that environment

Queries crt.sh over HTTPS to find subdomains recorded in public certificate logs. No active scanning or brute-forcing — entirely passive and firewall-friendly.

Connects directly to the target on port 443 to retrieve certificate expiry, cipher suite, Subject Alternative Names, and issuer information in structured JSON.

Contacts authoritative WHOIS servers over TCP:43 for registrar name, registration and expiry dates, and name servers. Covers over 100 top-level domains.

Resolves A, AAAA, MX, NS, TXT, and CNAME records using system DNS for A/AAAA and Google DNS-over-HTTPS for other record types, keeping queries firewall-friendly.

Accepts multiple domains and multiple check types in a single command, running queries concurrently via concurrent.futures for fast results at scale.

Built entirely on the Python standard library (socket, ssl, urllib, json, concurrent.futures). No pip installs, no API keys, no accounts — works identically on Linux, macOS, and Windows.

Security researchers and defenders can quickly map an organization's publicly visible subdomain surface using passive Certificate Transparency data — no active probing required.

Check expiry dates, cipher suites, and SANs across a list of domains in one bulk command, useful for ops teams monitoring certificate hygiene.

Passively determine whether target domains are registered, who owns them, and when they expire — useful for brand protection or acquisition planning.

Combine DNS, WHOIS, and subdomain data to build a structured picture of an organization's domain infrastructure before a security assessment or audit.