domain-scout-ct 0.2.1

Discover internet domains associated with a business entity via CT logs, RDAP, and DNS

domain-scout

Discover internet domains associated with a business entity using Certificate Transparency logs, RDAP, and DNS.

Useful for security teams, asset inventories, and M&A due diligence — where seed domains can be wrong, misspelled, or belong to a parent company.

Install

pip install domain-scout-ct

For development:

uv sync --all-groups

Usage

CLI

# Basic usage
domain-scout --name "Guidewire Software" --location "San Mateo, CA"

# With seed domain
domain-scout --name "Palo Alto Networks" --location "Santa Clara, CA" --seed "paloaltonetworks.com"

# Multiple seeds — cross-verification boosts confidence for domains found by both
domain-scout --name "Walmart" --seed walmart.com --seed samsclub.com

# Deep mode — GeoDNS global resolution for non-resolving domains
domain-scout --name "Walmart" --seed "walmart.com" --deep

# JSON output
domain-scout --name "Acme Corp" --output json > results.json

# Verbose logging
domain-scout --name "Cloudflare" --seed "cloudflare.com" -v

Library

from domain_scout import Scout

result = Scout().discover(
    company_name="Palo Alto Networks",
    location="Santa Clara, CA",
    seed_domain=["paloaltonetworks.com"],
)

for domain in result.domains:
    print(f"{domain.domain:40s}  {domain.confidence:.2f}  {domain.sources}")

Async

import asyncio
from domain_scout import Scout, EntityInput

async def main():
    scout = Scout()
    result = await scout.discover_async(EntityInput(
        company_name="Palo Alto Networks",
        seed_domain=["paloaltonetworks.com"],
    ))
    return result

result = asyncio.run(main())

How it works

1. Seed validation — DNS-resolves the seed domain, checks RDAP registrant org and CT cert org names against the company name
2. CT org search — Queries crt.sh Postgres for certificates where the Subject Organization matches the company name
3. Seed expansion — Finds all SANs on certs covering the seed domain, revealing related domains (e.g., acquired companies)
4. Domain guessing — Generates candidates from the company name + common TLDs, resolves them, verifies via CT
5. Cross-seed verification — With multiple seeds, domains found independently by 2+ seeds get a confidence boost
6. Confidence scoring — Scores each domain 0–1 based on org match, SAN co-occurrence, DNS resolution, cross-seed verification, and shared infrastructure

Data sources

Source	Method	Rate limited
crt.sh	Postgres (primary), JSON API (fallback)	5 concurrent queries, 1s burst delay
RDAP	rdap.org universal bootstrap	Per-request
DNS	dnspython (8.8.8.8, 1.1.1.1)	5 concurrent
Shodan GeoDNS	geonet.shodan.io (deep mode)	3 concurrent, 0.5s delay

Development

make install      # uv sync --all-groups
make test         # unit tests (mocked external calls)
make lint         # ruff + mypy
make format       # ruff --fix + ruff format
make check        # format + lint + test

Integration tests hit real crt.sh:

make test-integration

License

MIT