{"slug": "can-a-smartphone-ai-agent-detect-subdomain-takeover-risks-via-whois", "title": "Can a Smartphone AI Agent Detect Subdomain Takeover Risks via WHOIS?", "summary": "Nightcrawler, a local AI pentesting agent that runs on a smartphone, can detect subdomain takeover risks by leveraging the Domain WHOIS API from RapidAPI. The API bundles subdomain enumeration, DNS resolution, and takeover-risk scoring into a single JSON response, enabling the on-device LLM to reason over structured data without heavy local computation. A Python helper demonstrates how the agent can query the API and generate a markdown report for escalation.", "body_md": "`#cybersecurity`\n\n`#bugbounty`\n\n`#aiagents`\n\n`#pentesting`\n\n`#whois`\n\n`#subdomaintakeover`\n\n`#rapidapi`\n\n`#nightcrawler`\n\nA few days ago a Show HN project called **Nightcrawler** caught my attention: a local AI pentesting agent that runs entirely on a smartphone. The idea is compelling — carry an offensive-security assistant in your pocket, no cloud GPU required. But local LLMs on a phone are compute-starved. They cannot brute-force subdomains, resolve thousands of DNS records, or pull historical WHOIS/RDAP snapshots without draining the battery and burning through mobile data.\n\nThat is exactly where a lightweight reconnaissance API shines. If Nightcrawler wants to map an attack surface, it should not do the heavy lifting itself. It should call a backend that already knows how to:\n\nThe **Domain WHOIS API** bundles all of that into one request. In this article I’ll show you how to turn that API into a reconnaissance backend that a phone-based agent like Nightcrawler can use to flag subdomain takeover risks in seconds.\n\nSubdomain takeover is one of the highest-impact, lowest-complexity bugs in bug bounty programs. An attacker finds a dangling DNS record — for example `docs.example.com`\n\nstill pointing to a GitHub Pages or Heroku app that no longer exists — and claims it. The fix is usually just deleting the DNS record, but finding the dangling records at scale is the hard part.\n\nA smartphone agent cannot run `amass`\n\n, `subfinder`\n\n, and `dnsx`\n\npipelines locally without melting the SoC. Instead, it can ask:\n\n“API, here is a target domain. Give me subdomains, their DNS resolution status, any dangling CNAMEs, and a takeover-risk score.”\n\nThen the local LLM simply reasons over the structured JSON response and decides whether to escalate the finding to the user.\n\nThe **Domain WHOIS API** response is a single JSON document that combines several recon tools. A typical payload looks like this:\n\n```\n{\n  \"domain\": \"example.com\",\n  \"rdap\": {\n    \"registrar\": \"Example Registrar, Inc.\",\n    \"creation_date\": \"1995-08-14\",\n    \"expiration_date\": \"2025-08-13\",\n    \"name_servers\": [\"ns1.example.com\", \"ns2.example.com\"]\n  },\n  \"dns\": {\n    \"A\": [\"93.184.216.34\"],\n    \"AAAA\": [\"2606:2800:220:1::\"],\n    \"MX\": [\"mail.example.com\"],\n    \"TXT\": [\"v=spf1 include:_spf.example.com ~all\"],\n    \"NS\": [\"ns1.example.com\"]\n  },\n  \"ssl\": {\n    \"issuer\": \"DigiCert Inc\",\n    \"subject\": \"CN=example.com\",\n    \"not_after\": \"2025-01-15\"\n  },\n  \"subdomains\": [\n    \"www.example.com\",\n    \"mail.example.com\",\n    \"docs.example.com\",\n    \"staging.example.com\"\n  ],\n  \"takeover_risk\": {\n    \"score\": 7.2,\n    \"dangling_cnames\": [\n      {\n        \"subdomain\": \"docs.example.com\",\n        \"cname\": \"example.github.io\",\n        \"status\": \"unregistered\"\n      }\n    ]\n  },\n  \"email_security\": {\n    \"spf\": \"pass\",\n    \"dmarc\": \"pass\",\n    \"dkim\": \"neutral\",\n    \"dnssec\": \"signed\",\n    \"mta_sts\": \"missing\",\n    \"score\": 82\n  }\n}\n```\n\nWith that one response, an agent can:\n\nBelow is a small Python helper that any local agent can embed. It queries the API, extracts high-risk subdomains, and prints a markdown report that the LLM can consume.\n\n``` python\nimport os\nimport requests\n\nRAPIDAPI_KEY = os.environ[\"RAPIDAPI_KEY\"]\nAPI_HOST = \"domain-whois2.p.rapidapi.com\"\nBASE_URL = f\"https://{API_HOST}\"\n\ndef whois_recon(domain: str) -> dict:\n    url = f\"{BASE_URL}/whois/{domain}\"\n    headers = {\n        \"X-RapidAPI-Key\": RAPIDAPI_KEY,\n        \"X-RapidAPI-Host\": API_HOST,\n    }\n    resp = requests.get(url, headers=headers, timeout=45)\n    resp.raise_for_status()\n    return resp.json()\n\ndef takeover_report(domain: str) -> str:\n    data = whois_recon(domain)\n    risk = data.get(\"takeover_risk\", {})\n    dangling = risk.get(\"dangling_cnames\", [])\n    email = data.get(\"email_security\", {})\n\n    lines = [f\"# Recon report for `{domain}`\\n\"]\n    lines.append(f\"- **Domain age:** {data.get('rdap', {}).get('creation_date')}\")\n    lines.append(f\"- **Takeover risk score:** {risk.get('score', 'N/A')}\")\n    lines.append(f\"- **Email security score:** {email.get('score', 'N/A')}\\n\")\n\n    if dangling:\n        lines.append(\"## 🚨 Potential subdomain takeovers\")\n        for item in dangling:\n            lines.append(\n                f\"- `{item['subdomain']}` → CNAME `{item['cname']}` ({item['status']})\"\n            )\n    else:\n        lines.append(\"No dangling CNAMEs detected.\")\n\n    return \"\\n\".join(lines)\n\nif __name__ == \"__main__\":\n    print(takeover_report(\"example.com\"))\n```\n\nThe report is intentionally markdown-shaped so a local LLM can parse it as tool output and decide whether to recommend further exploitation steps (always inside a legal, authorized scope).\n\nIf Nightcrawler is given a list of in-scope domains, it can parallelize reconnaissance without running any local DNS tooling:\n\n``` python\nfrom concurrent.futures import ThreadPoolExecutor\n\nTARGETS = [\n    \"example.com\",\n    \"acme.org\",\n    \"bugbounty-target.io\",\n]\n\ndef scan_domain(domain: str):\n    try:\n        data = whois_recon(domain)\n        risk = data.get(\"takeover_risk\", {}).get(\"score\", 0)\n        if risk and risk >= 6.0:\n            return {\n                \"domain\": domain,\n                \"risk_score\": risk,\n                \"dangling\": data.get(\"takeover_risk\", {}).get(\"dangling_cnames\", []),\n            }\n    except requests.RequestException as exc:\n        return {\"domain\": domain, \"error\": str(exc)}\n    return None\n\nwith ThreadPoolExecutor(max_workers=5) as pool:\n    results = pool.map(scan_domain, TARGETS)\n\nfor r in results:\n    if r:\n        print(r)\n```\n\nThis keeps the phone’s workload tiny: one HTTP request per domain, then pure decision logic on the device.\n\n`/history`\n\nsuperpower\nOne of the most useful features for an AI pentester is the ability to see how a target changed over time. The `/history/{domain}`\n\nendpoint returns historical snapshots of email-security records and subdomains, which is perfect for detecting infrastructure drift.\n\n``` php\ndef history_recon(domain: str) -> dict:\n    url = f\"{BASE_URL}/history/{domain}\"\n    headers = {\n        \"X-RapidAPI-Key\": RAPIDAPI_KEY,\n        \"X-RapidAPI-Host\": API_HOST,\n    }\n    resp = requests.get(url, headers=headers, timeout=45)\n    resp.raise_for_status()\n    return resp.json()\n\n# Example: find when a subdomain first appeared or disappeared.\nhistory = history_recon(\"example.com\")\nprint(history.get(\"subdomain_snapshots\", [])[:3])\n```\n\nIf `docs.example.com`\n\nexisted three months ago, disappeared from DNS yesterday, but its CNAME is still live, that is a prime takeover candidate.\n\nThe API is hosted on RapidAPI. Sign up, subscribe, and grab your key from the dashboard:\n\n👉 **Domain WHOIS API on RapidAPI:** [https://rapidapi.com/On13uka/api/domain-whois2](https://rapidapi.com/On13uka/api/domain-whois2)\n\n```\ncurl --request GET \\\n  --url 'https://domain-whois2.p.rapidapi.com/whois/example.com' \\\n  --header 'X-RapidAPI-Key: YOUR_RAPIDAPI_KEY' \\\n  --header 'X-RapidAPI-Host: domain-whois2.p.rapidapi.com'\npython\nimport requests\n\nurl = \"https://domain-whois2.p.rapidapi.com/whois/example.com\"\nheaders = {\n    \"X-RapidAPI-Key\": \"YOUR_RAPIDAPI_KEY\",\n    \"X-RapidAPI-Host\": \"domain-whois2.p.rapidapi.com\",\n}\n\nresponse = requests.get(url, headers=headers)\nprint(response.json())\n```\n\nReplace `YOUR_RAPIDAPI_KEY`\n\nwith the key from your RapidAPI dashboard. The exact endpoint paths (`/whois/{domain}`\n\n, `/history/{domain}`\n\n) are documented in the RapidAPI console, so check there for the latest route definitions and rate-limit details.\n\nIf you want to self-host a thin proxy, contribute improvements, or just inspect the implementation, the project is open source:\n\n👉 **GitHub repository:** [https://github.com/On13uka/domain-whois-api](https://github.com/On13uka/domain-whois-api)\n\nYou can fork it, add your own scoring logic, or build a FastAPI shim that Nightcrawler talks to over your private network.\n\nLocal AI pentesting agents like Nightcrawler are a fascinating shift: intelligence stays on the device, but raw reconnaissance does not have to. By offloading WHOIS/RDAP, DNS, SSL, subdomain discovery, takeover risk, and email-security scoring to the **Domain WHOIS API**, a smartphone agent can map attack surfaces in seconds without draining the battery or hammering mobile networks.\n\nIf you are building a phone-based security agent, bug-bounty automation, or a threat-intel dashboard, plug this API in as your reconnaissance layer. Your local LLM gets clean, structured data; your phone stays cool; and you get to focus on the actual exploitation logic — inside authorized scopes, of course.\n\nHappy hacking, and may your subdomains never dangle.", "url": "https://wpnews.pro/news/can-a-smartphone-ai-agent-detect-subdomain-takeover-risks-via-whois", "canonical_source": "https://dev.to/onizuka/can-a-smartphone-ai-agent-detect-subdomain-takeover-risks-via-whois-42h9", "published_at": "2026-08-03 13:00:49+00:00", "updated_at": "2026-08-03 13:16:08.575580+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-agents", "developer-tools"], "entities": ["Nightcrawler", "RapidAPI", "Domain WHOIS API"], "alternates": {"html": "https://wpnews.pro/news/can-a-smartphone-ai-agent-detect-subdomain-takeover-risks-via-whois", "markdown": "https://wpnews.pro/news/can-a-smartphone-ai-agent-detect-subdomain-takeover-risks-via-whois.md", "text": "https://wpnews.pro/news/can-a-smartphone-ai-agent-detect-subdomain-takeover-risks-via-whois.txt", "jsonld": "https://wpnews.pro/news/can-a-smartphone-ai-agent-detect-subdomain-takeover-risks-via-whois.jsonld"}}