Domain-centric OSINT gathering including WHOIS, DNS records, SSL/TLS certificates, subdomain discovery, and historical records. Use when investigating domains for security research, threat intelligence, or due diligence. Returns comprehensive domain intelligence report.
Gathers comprehensive intelligence about domains from public sources.
ONE RESPONSIBILITY: Gather domain-centric intelligence (WHOIS, DNS, SSL, subdomains, history)
NOT RESPONSIBLE FOR:
Domain intelligence report (JSON format):
{
"investigation_id": "OSINT-DOMAIN-uuid",
"timestamp": "ISO-8601",
"target_domain": "example.com",
"risk_score": "Low|Medium|High|Critical",
"findings": {
"whois": {
"registrar": "Example Registrar",
"registrant": "Company Name",
"registration_date": "2020-01-01",
"expiry_date": "2025-01-01",
"name_servers": ["ns1.example.com", "ns2.example.com"],
"status": ["clientTransferProhibited"]
},
"dns": {
"a_records": ["1.2.3.4"],
"mx_records": ["mail.example.com"],
"txt_records": ["v=spf1 include:_spf.example.com ~all"],
"ns_records": ["ns1.example.com"],
"cname_records": {},
"dnssec": true
},
"ssl_tls": {
"valid": true,
"issuer": "Let's Encrypt",
"valid_from": "2025-01-01",
"valid_until": "2025-04-01",
"subject_alt_names": ["example.com", "www.example.com"],
"certificate_transparency": true
},
"subdomains": [
"www.example.com",
"api.example.com",
"mail.example.com"
],
"historical": {
"previous_owners": [],
"ip_history": [],
"wayback_snapshots": 150
}
},
"recommendations": []
}
# Basic domain investigation
python scripts/domain_osint.py --domain example.com --output report.json
# Comprehensive investigation with history
python scripts/domain_osint.py --domain example.com --depth comprehensive --historical
# Quick DNS check
python scripts/domain_osint.py --domain example.com --depth basic
domain_osint.py: Main domain intelligence gathererwhois_lookup.py: WHOIS data extractiondns_enum.py: DNS record enumerationssl_analyzer.py: SSL/TLS certificate analysissubdomain_enum.py: Subdomain discovery