{"id":13539841,"url":"https://github.com/threatexpress/domainhunter","last_synced_at":"2025-05-15T14:07:19.223Z","repository":{"id":41161998,"uuid":"83546302","full_name":"threatexpress/domainhunter","owner":"threatexpress","description":"Checks expired domains for categorization/reputation and Archive.org history to determine good candidates for phishing and C2 domain names","archived":false,"fork":false,"pushed_at":"2024-06-06T21:01:21.000Z","size":117,"stargazers_count":1573,"open_issues_count":8,"forks_count":289,"subscribers_count":61,"default_branch":"master","last_synced_at":"2025-02-16T10:01:51.841Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"http://threatexpress.com","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/threatexpress.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-03-01T11:16:26.000Z","updated_at":"2025-02-15T18:09:52.000Z","dependencies_parsed_at":"2024-11-21T00:26:40.372Z","dependency_job_id":"a95cf70b-f2c5-4ea3-adbe-44edd3ea5b02","html_url":"https://github.com/threatexpress/domainhunter","commit_stats":null,"previous_names":["minisllc/domainhunter"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/threatexpress%2Fdomainhunter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/threatexpress%2Fdomainhunter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/threatexpress%2Fdomainhunter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/threatexpress%2Fdomainhunter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/threatexpress","download_url":"https://codeload.github.com/threatexpress/domainhunter/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254355335,"owners_count":22057354,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T09:01:32.807Z","updated_at":"2025-05-15T14:07:14.205Z","avatar_url":"https://github.com/threatexpress.png","language":"Python","funding_links":[],"categories":["Python (1887)","Python","\u003ca id=\"546f4fe70faa2236c0fbc2d486a83391\"\u003e\u003c/a\u003e社工(SET)\u0026\u0026钓鱼\u0026\u0026鱼叉攻击","\u003ca id=\"3e622bff3199cf22fe89db026b765cd4\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"ce734598055ad3885d45d0b35d2bf0d7\"\u003e\u003c/a\u003e未分类-SET"],"readme":"# Domain Hunter\n\nAuthors Joe Vest (@joevest) \u0026 Andrew Chiles (@andrewchiles)\n\nDomain name selection is an important aspect of preparation for penetration tests and especially Red Team engagements. Commonly, domains that were used previously for benign purposes and were properly categorized can be purchased for only a few dollars. Such domains can allow a team to bypass reputation based web filters and network egress restrictions for phishing and C2 related tasks. \n\nThis Python based tool was written to quickly query the Expireddomains.net search engine for expired/available domains with a previous history of use. It then optionally queries for domain reputation against services like Symantec Site Review (BlueCoat), IBM X-Force, and Cisco Talos. The primary tool output is a timestamped HTML table style report.\n\nSee [CHANGELOG](./CHANGELOG) for history of updates and release notes!\n\n## Features\n\n- Retrieve specified number of recently expired and deleted domains (.com, .net, .org) from ExpiredDomains.net\n  - Note: You will need credentials from expireddomains.net for full functionality\n- Retrieve available domains based on keyword search from ExpiredDomains.net\n- Perform reputation checks against the Symantec WebPulse Site Review (BlueCoat), IBM x-Force, and Cisco Talos\n- Sort results by domain age (if known) and filter for reputation\n- Text-based table and HTML report output with links to reputation sources and Archive.org entry\n\n## Installation\n\n### Direct Installation\n\nInstall Python requirements\n\n    pip3 install -r requirements.txt\n    \nOptional - Install additional OCR support dependencies\n\n- Debian/Ubuntu: `apt-get install tesseract-ocr python3-pil`\n\n- MAC OSX: `brew install tesseract`\n\n### pipenv installation\n\n    pipenv --python 3.7\n    pipenv install\n\nOptional - Install additional OCR support dependencies\n\n- Debian/Ubuntu: `apt-get install tesseract-ocr python3-pil`\n\n### Docker\n\n1. Build the image\n`docker build -t domainhunter .`\n\n2. Run it with your arguments\n`docker run -it domainhunter [args]`\n\n## Usage\n\n    usage: domainhunter.py [-h] [-a] [-k KEYWORD] [-c] [-f FILENAME] [--ocr]\n                        [-r MAXRESULTS] [-s SINGLE] [-t {0,1,2,3,4,5}]\n                        [-w MAXWIDTH] [-V]\n\n    Finds expired domains, domain categorization, and Archive.org history to determine good candidates for C2 and phishing domains\n\n    optional arguments:\n    -h, --help            show this help message and exit\n    -a, --alexa           Filter results to Alexa listings\n    -k KEYWORD, --keyword KEYWORD\n                            Keyword used to refine search results\n    -c, --check           Perform domain reputation checks\n    -f FILENAME, --filename FILENAME\n                            Specify input file of line delimited domain names to\n                            check\n    --ocr                 Perform OCR on CAPTCHAs when challenged\n    -r MAXRESULTS, --maxresults MAXRESULTS\n                            Number of results to return when querying latest\n                            expired/deleted domains\n    -s SINGLE, --single SINGLE\n                            Performs detailed reputation checks against a single\n                            domain name/IP.\n    -t {0,1,2,3,4,5}, --timing {0,1,2,3,4,5}\n                            Modifies request timing to avoid CAPTCHAs. Slowest(0)\n                            = 90-120 seconds, Default(3) = 10-20 seconds,\n                            Fastest(5) = no delay\n    -w MAXWIDTH, --maxwidth MAXWIDTH\n                            Width of text table\n    -V, --version         show program's version number and exit\n\n    Examples:\n    ./domainhunter.py -k apples -c --ocr -t5\n    ./domainhunter.py --check --ocr -t3\n    ./domainhunter.py --single mydomain.com\n    ./domainhunter.py --keyword tech --check --ocr --timing 5 --alexa\n    ./domaihunter.py --filename inputlist.txt --ocr --timing 5\n\nUse defaults to check for most recent 100 domains and check reputation\n    \n    python3 ./domainhunter.py\n\nSearch for 1000 most recently expired/deleted domains, but don't check reputation\n\n    python3 ./domainhunter.py -r 1000\n\nPerform all reputation checks for a single domain\n\n    python3 ./domainhunter.py -s mydomain.com\n\n    [*] Downloading malware domain list from http://mirror1.malwaredomains.com/files/justdomains\n\n    [*] Fetching domain reputation for: mydomain.com\n    [*] BlueCoat: mydomain.com\n    [+] mydomain.com: Technology/Internet\n    [*] IBM xForce: mydomain.com\n    [+] mydomain.com: Communication Services, Software as a Service, Cloud, (Score: 1)\n    [*] Cisco Talos: mydomain.com\n    [+] mydomain.com: Web Hosting (Score: Neutral)\n\nPerform all reputation checks for a list of domains at max speed with OCR of CAPTCHAs\n\n    python3 ./domainhunter.py -f \u003cdomainslist.txt\u003e -t 5 --ocr\n\nSearch for available domains with keyword term of \"dog\", max results of 25, and check reputation\n    \n    python3 ./domainhunter.py -k dog -r 25 -c\n\n     ____   ___  __  __    _    ___ _   _   _   _ _   _ _   _ _____ _____ ____\n    |  _ \\ / _ \\|  \\/  |  / \\  |_ _| \\ | | | | | | | | | \\ | |_   _| ____|  _ \\\n    | | | | | | | |\\/| | / _ \\  | ||  \\| | | |_| | | | |  \\| | | | |  _| | |_) |\n    | |_| | |_| | |  | |/ ___ \\ | || |\\  | |  _  | |_| | |\\  | | | | |___|  _ \u003c\n    |____/ \\___/|_|  |_/_/   \\_\\___|_| \\_| |_| |_|\\___/|_| \\_| |_| |_____|_| \\_\\\n\n    Expired Domains Reputation Checker\n    Authors: @joevest and @andrewchiles\n\n    DISCLAIMER: This is for educational purposes only!\n    It is designed to promote education and the improvement of computer/cyber security.\n    The authors or employers are not liable for any illegal act or misuse performed by any user of this tool.\n    If you plan to use this content for illegal purpose, don't.  Have a nice day :)\n\n    [*] Downloading malware domain list from http://mirror1.malwaredomains.com/files/justdomains\n\n    [*] Fetching expired or deleted domains containing \"dog\"\n    [*]  https://www.expireddomains.net/domain-name-search/?q=dog\n\n    [*] Performing domain reputation checks for 8 domains.\n    [*] BlueCoat: doginmysuitcase.com\n    [+] doginmysuitcase.com: Travel\n    [*] IBM xForce: doginmysuitcase.com\n    [+] doginmysuitcase.com: Not found.\n    [*] Cisco Talos: doginmysuitcase.com\n    [+] doginmysuitcase.com: Uncategorized\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthreatexpress%2Fdomainhunter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fthreatexpress%2Fdomainhunter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthreatexpress%2Fdomainhunter/lists"}