Can a Smartphone AI Agent Detect Subdomain Takeover Risks via WHOIS?

Nightcrawler, a local AI pentesting agent that runs on a smartphone, can detect subdomain takeover risks by leveraging the Domain WHOIS API from RapidAPI. The API bundles subdomain enumeration, DNS resolution, and takeover-risk scoring into a single JSON response, enabling the on-device LLM to reason over structured data without heavy local computation. A Python helper demonstrates how the agent can query the API and generate a markdown report for escalation.

cybersecurity bugbounty aiagents pentesting whois subdomaintakeover rapidapi nightcrawler A few days ago a Show HN project called Nightcrawler caught my attention: a local AI pentesting agent that runs entirely on a smartphone. The idea is compelling — carry an offensive-security assistant in your pocket, no cloud GPU required. But local LLMs on a phone are compute-starved. They cannot brute-force subdomains, resolve thousands of DNS records, or pull historical WHOIS/RDAP snapshots without draining the battery and burning through mobile data. That is exactly where a lightweight reconnaissance API shines. If Nightcrawler wants to map an attack surface, it should not do the heavy lifting itself. It should call a backend that already knows how to: The Domain WHOIS API bundles all of that into one request. In this article I’ll show you how to turn that API into a reconnaissance backend that a phone-based agent like Nightcrawler can use to flag subdomain takeover risks in seconds. Subdomain takeover is one of the highest-impact, lowest-complexity bugs in bug bounty programs. An attacker finds a dangling DNS record — for example docs.example.com still pointing to a GitHub Pages or Heroku app that no longer exists — and claims it. The fix is usually just deleting the DNS record, but finding the dangling records at scale is the hard part. A smartphone agent cannot run amass , subfinder , and dnsx pipelines locally without melting the SoC. Instead, it can ask: “API, here is a target domain. Give me subdomains, their DNS resolution status, any dangling CNAMEs, and a takeover-risk score.” Then the local LLM simply reasons over the structured JSON response and decides whether to escalate the finding to the user. The Domain WHOIS API response is a single JSON document that combines several recon tools. A typical payload looks like this: { "domain": "example.com", "rdap": { "registrar": "Example Registrar, Inc.", "creation date": "1995-08-14", "expiration date": "2025-08-13", "name servers": "ns1.example.com", "ns2.example.com" }, "dns": { "A": "93.184.216.34" , "AAAA": "2606:2800:220:1::" , "MX": "mail.example.com" , "TXT": "v=spf1 include: spf.example.com ~all" , "NS": "ns1.example.com" }, "ssl": { "issuer": "DigiCert Inc", "subject": "CN=example.com", "not after": "2025-01-15" }, "subdomains": "www.example.com", "mail.example.com", "docs.example.com", "staging.example.com" , "takeover risk": { "score": 7.2, "dangling cnames": { "subdomain": "docs.example.com", "cname": "example.github.io", "status": "unregistered" } }, "email security": { "spf": "pass", "dmarc": "pass", "dkim": "neutral", "dnssec": "signed", "mta sts": "missing", "score": 82 } } With that one response, an agent can: Below is a small Python helper that any local agent can embed. It queries the API, extracts high-risk subdomains, and prints a markdown report that the LLM can consume. python import os import requests RAPIDAPI KEY = os.environ "RAPIDAPI KEY" API HOST = "domain-whois2.p.rapidapi.com" BASE URL = f"https://{API HOST}" def whois recon domain: str - dict: url = f"{BASE URL}/whois/{domain}" headers = { "X-RapidAPI-Key": RAPIDAPI KEY, "X-RapidAPI-Host": API HOST, } resp = requests.get url, headers=headers, timeout=45 resp.raise for status return resp.json def takeover report domain: str - str: data = whois recon domain risk = data.get "takeover risk", {} dangling = risk.get "dangling cnames", email = data.get "email security", {} lines = f" Recon report for {domain} \n" lines.append f"- Domain age: {data.get 'rdap', {} .get 'creation date' }" lines.append f"- Takeover risk score: {risk.get 'score', 'N/A' }" lines.append f"- Email security score: {email.get 'score', 'N/A' }\n" if dangling: lines.append " 🚨 Potential subdomain takeovers" for item in dangling: lines.append f"- {item 'subdomain' } → CNAME {item 'cname' } {item 'status' } " else: lines.append "No dangling CNAMEs detected." return "\n".join lines if name == " main ": print takeover report "example.com" The report is intentionally markdown-shaped so a local LLM can parse it as tool output and decide whether to recommend further exploitation steps always inside a legal, authorized scope . If Nightcrawler is given a list of in-scope domains, it can parallelize reconnaissance without running any local DNS tooling: python from concurrent.futures import ThreadPoolExecutor TARGETS = "example.com", "acme.org", "bugbounty-target.io", def scan domain domain: str : try: data = whois recon domain risk = data.get "takeover risk", {} .get "score", 0 if risk and risk = 6.0: return { "domain": domain, "risk score": risk, "dangling": data.get "takeover risk", {} .get "dangling cnames", , } except requests.RequestException as exc: return {"domain": domain, "error": str exc } return None with ThreadPoolExecutor max workers=5 as pool: results = pool.map scan domain, TARGETS for r in results: if r: print r This keeps the phone’s workload tiny: one HTTP request per domain, then pure decision logic on the device. /history superpower One of the most useful features for an AI pentester is the ability to see how a target changed over time. The /history/{domain} endpoint returns historical snapshots of email-security records and subdomains, which is perfect for detecting infrastructure drift. php def history recon domain: str - dict: url = f"{BASE URL}/history/{domain}" headers = { "X-RapidAPI-Key": RAPIDAPI KEY, "X-RapidAPI-Host": API HOST, } resp = requests.get url, headers=headers, timeout=45 resp.raise for status return resp.json Example: find when a subdomain first appeared or disappeared. history = history recon "example.com" print history.get "subdomain snapshots", :3 If docs.example.com existed three months ago, disappeared from DNS yesterday, but its CNAME is still live, that is a prime takeover candidate. The API is hosted on RapidAPI. Sign up, subscribe, and grab your key from the dashboard: 👉 Domain WHOIS API on RapidAPI: https://rapidapi.com/On13uka/api/domain-whois2 https://rapidapi.com/On13uka/api/domain-whois2 curl --request GET \ --url 'https://domain-whois2.p.rapidapi.com/whois/example.com' \ --header 'X-RapidAPI-Key: YOUR RAPIDAPI KEY' \ --header 'X-RapidAPI-Host: domain-whois2.p.rapidapi.com' python import requests url = "https://domain-whois2.p.rapidapi.com/whois/example.com" headers = { "X-RapidAPI-Key": "YOUR RAPIDAPI KEY", "X-RapidAPI-Host": "domain-whois2.p.rapidapi.com", } response = requests.get url, headers=headers print response.json Replace YOUR RAPIDAPI KEY with the key from your RapidAPI dashboard. The exact endpoint paths /whois/{domain} , /history/{domain} are documented in the RapidAPI console, so check there for the latest route definitions and rate-limit details. If you want to self-host a thin proxy, contribute improvements, or just inspect the implementation, the project is open source: 👉 GitHub repository: https://github.com/On13uka/domain-whois-api https://github.com/On13uka/domain-whois-api You can fork it, add your own scoring logic, or build a FastAPI shim that Nightcrawler talks to over your private network. Local AI pentesting agents like Nightcrawler are a fascinating shift: intelligence stays on the device, but raw reconnaissance does not have to. By offloading WHOIS/RDAP, DNS, SSL, subdomain discovery, takeover risk, and email-security scoring to the Domain WHOIS API , a smartphone agent can map attack surfaces in seconds without draining the battery or hammering mobile networks. If you are building a phone-based security agent, bug-bounty automation, or a threat-intel dashboard, plug this API in as your reconnaissance layer. Your local LLM gets clean, structured data; your phone stays cool; and you get to focus on the actual exploitation logic — inside authorized scopes, of course. Happy hacking, and may your subdomains never dangle.