Domain Intelligence Tool

A Python3 tool for passive OSINT, cybersecurity research, domain investigation, and defensive security analysis.

This tool collects WHOIS, DNS, MX, SPF, DMARC, ASN, approximate GeoIP, and TLS certificate information, then produces a defensive risk summary and optional exports.

This tool is intended for authorized OSINT, research, educational, and defensive security purposes only. Users are responsible for complying with applicable laws, service terms, and API usage policies.

Screenshot

▓█████▄  ▒█████   ███▄ ▄███▓ ▄▄▄       ██▓ ███▄    █ ...

Domain Intelligence Tool
Target: example.com
Started: 2026-07-27 14:30:00

[1/8] WHOIS Intelligence
[2/8] DNS Records
[3/8] MX Intelligence
[4/8] SPF Analysis
[5/8] DMARC Analysis
[6/8] ASN Intelligence
[7/8] GeoIP Intelligence
[8/8] TLS Certificate

Risk Summary
Export Results

Features

• Domain and URL normalization with IDNA/Punycode support
• WHOIS registrar, date, nameserver, DNSSEC, and abuse-contact extraction
• DNS collection for A, AAAA, CNAME, NS, SOA, MX, TXT, CAA, and DNSKEY
• MX resolution and hosted email provider estimation
• SPF parsing with policy and DNS lookup warnings
• DMARC parsing with policy, reporting, alignment, and percentage checks
• ASN intelligence through public RDAP data
• Approximate GeoIP information for public IP addresses
• TLS certificate and HTTPS endpoint analysis with hostname verification
• Rich terminal tables, panels, spinner progress, and no-color mode
• JSON, TXT, and Excel-friendly CSV exports
• Local logging to logs/domain_intelligence.log

Installation on Windows

git clone https://github.com/USERNAME/domain-intelligence-tool.git
cd domain-intelligence-tool

python -m venv venv
venv\Scripts\activate

python -m pip install --upgrade pip
pip install -r requirements.txt

python domain_intelligence.py example.com

If Windows opens the Microsoft Store instead of Python, install Python from python.org and enable "Add python.exe to PATH" during setup.

Usage

Interactive mode:

python domain_intelligence.py

Command-line mode:

python domain_intelligence.py example.com
python domain_intelligence.py https://example.com/page --full
python domain_intelligence.py example.com --dns
python domain_intelligence.py example.com --dns --srv
python domain_intelligence.py example.com --tls
python domain_intelligence.py example.com --tls-port 8443
python domain_intelligence.py example.com --export-json
python domain_intelligence.py example.com --export-txt
python domain_intelligence.py example.com --export-csv
python domain_intelligence.py example.com --export-json --export-txt --export-csv --output results

CLI Arguments

domain                     Domain or URL to investigate
--full                     Run all intelligence modules
--whois                    Run WHOIS analysis
--dns                      Run DNS analysis
--mx                       Run MX analysis
--spf                      Run SPF analysis
--dmarc                    Run DMARC analysis
--asn                      Run ASN analysis
--geoip                    Run GeoIP analysis
--tls                      Run TLS analysis
--tls-port PORT            Custom TLS port
--srv                      Include SRV records during DNS analysis
--dns-server SERVER        Custom DNS resolver
--timeout SECONDS          Network timeout
--export-json              Export results to JSON
--export-txt               Export results to TXT
--export-csv               Export suitable records to CSV
--output DIRECTORY         Export directory
--no-color                 Disable terminal colors
--verbose                  Display detailed errors
--version                  Display program version
--help                     Display help

When no module flag is selected, all modules run by default.

Export Formats

Exports are written to a sanitized per-domain folder:

results/
└── example.com/
    ├── report.json
    ├── report.txt
    ├── dns_records.csv
    ├── ip_intelligence.csv
    └── tls_certificate.txt

JSON contains structured data suitable for automation. TXT is human-readable. CSV files use UTF-8 with BOM so Microsoft Excel detects encoding cleanly.

Project Structure

domain-intelligence-tool/
├── domain_intelligence.py
├── requirements.txt
├── README.md
├── LICENSE
├── .gitignore
├── .env.example
└── modules/
    ├── __init__.py
    ├── validators.py
    ├── whois_lookup.py
    ├── dns_lookup.py
    ├── mail_security.py
    ├── ip_intelligence.py
    ├── tls_analyzer.py
    ├── risk_analyzer.py
    └── exporters.py

Module Notes

• validators.py: extracts hostnames from domains or URLs, removes ports and paths, validates safely, and converts internationalized domains to IDNA.
• whois_lookup.py: handles variable WHOIS return formats and private or unavailable records.
• dns_lookup.py: queries DNS record types concurrently and classifies A/AAAA addresses.
• mail_security.py: analyzes MX resolution, SPF policy, and DMARC policy.
• ip_intelligence.py: gathers ASN and approximate GeoIP data for public IPs only.
• tls_analyzer.py: performs a verified TLS socket connection and summarizes certificate metadata.
• risk_analyzer.py: creates defensive configuration findings with INFO, LOW, MEDIUM, HIGH, and CRITICAL severities.
• exporters.py: writes JSON, TXT, DNS CSV, IP CSV, and TLS text exports.

API and Rate-Limit Notes

The default ASN collector uses public RDAP through ipwhois. GeoIP uses the free ip-api.com endpoint, which may rate-limit requests. The tool uses timeouts, skips non-public IP addresses, avoids duplicate IP requests, and continues when a remote service fails.

Optional future API keys can be loaded from .env, but no API key is required for the included basic functionality and no keys are hardcoded.

Troubleshooting

• ModuleNotFoundError: activate your virtual environment and run pip install -r requirements.txt.
• WHOIS unavailable: some registries throttle requests or hide fields for privacy.
• DNS timeout: try --dns-server 1.1.1.1 or increase --timeout 10.
• GeoIP errors: the public service may be rate-limited or temporarily unavailable.
• TLS failure: the host may not support HTTPS on the selected port or certificate verification may fail.
• Unicode display issues in Command Prompt: use Windows Terminal or run with --no-color.

Ethical Use

Use this tool only for domains you own, are authorized to assess, or are investigating for lawful defensive, educational, or research purposes. It does not perform exploitation, password attacks, takeover checks, brute-force enumeration, authentication bypass, or malicious traffic generation.