nethound 1.0.0__py3-none-any.whl

nethound/__init__.py

@@ -0,0 +1,7 @@
+"""
+NetHound - Newly Registered Domains (NRDs) Tracker & Threat Intelligence Extractor.
+"""
+
+__version__ = "1.0.0"
+__author__ = "xploitoverload"
+__license__ = "MIT"

nethound/cli.py

@@ -0,0 +1,211 @@
+import argparse
+import json
+import sys
+from datetime import datetime, timedelta
+from pathlib import Path
+
+from nethound import __version__
+from nethound.config import DEFAULT_DATA_DIR, parse_date
+from nethound.fetchers.registry_in import fetch_in_domains
+from nethound.fetchers.whoisds import fetch_whoisds_domains
+from nethound.search import search_domains, find_matching_files
+
+
+def cmd_fetch(args) -> int:
+    try:
+        target_date = parse_date(args.date)
+    except ValueError as e:
+        print(f"[!] {e}", file=sys.stderr)
+        return 1
+
+    tld_arg = args.tld.lower()
+    output_dir = Path(args.output_dir) if args.output_dir and not args.stdout else None
+    
+    # If not writing to stdout and no explicit output_dir, default to local directory
+    if not args.stdout and not output_dir:
+        output_dir = Path(".")
+
+    all_domains: dict[str, list[str]] = {}
+
+    # 1. Handle .IN TLD
+    if tld_arg in ("in", "all", "*"):
+        if not args.stdout:
+            print(f"[*] Fetching .IN domains for {target_date.strftime('%Y-%m-%d')}...", file=sys.stderr)
+        try:
+            in_domains = fetch_in_domains(target_date, output_dir=output_dir)
+            all_domains["in"] = in_domains
+            if not args.stdout:
+                print(f"[✓] Extracted {len(in_domains)} .IN domains.", file=sys.stderr)
+        except Exception as e:
+            if not args.stdout:
+                print(f"[!] Failed to fetch .IN domains: {e}", file=sys.stderr)
+
+    # 2. Handle WhoisDS TLDs (.com, others, specific)
+    if tld_arg != "in":
+        whois_target = "all" if tld_arg == "all" else tld_arg
+        if not args.stdout:
+            print(f"[*] Fetching WhoisDS domains ({whois_target}) for {target_date.strftime('%Y-%m-%d')}...", file=sys.stderr)
+        try:
+            whois_results = fetch_whoisds_domains(target_date, tld=whois_target, output_dir=output_dir)
+            for k, v in whois_results.items():
+                all_domains[k] = v
+                if not args.stdout:
+                    print(f"[✓] Extracted {len(v)} .{k} domains.", file=sys.stderr)
+        except Exception as e:
+            if not args.stdout:
+                print(f"[!] Failed to fetch WhoisDS domains: {e}", file=sys.stderr)
+
+    # Output formatting
+    if args.json:
+        payload = {
+            "date": target_date.strftime("%Y-%m-%d"),
+            "total_domains": sum(len(d) for d in all_domains.values()),
+            "tlds": {k: len(v) for k, v in all_domains.items()},
+            "domains": all_domains,
+        }
+        print(json.dumps(payload, indent=2))
+    elif args.stdout:
+        for tld_name, dom_list in all_domains.items():
+            for dom in dom_list:
+                print(dom)
+    else:
+        total = sum(len(d) for d in all_domains.values())
+        print(f"[*] Done. Total {total} domains saved into {output_dir.resolve()}/", file=sys.stderr)
+
+    return 0
+
+
+def cmd_search(args) -> int:
+    data_dir = Path(args.data_dir)
+    if not data_dir.exists():
+        print(f"[!] Data directory '{data_dir}' does not exist.", file=sys.stderr)
+        return 1
+
+    results = []
+    for domain, file_path in search_domains(
+        data_dir,
+        pattern=args.pattern,
+        regex=args.regex,
+        tld=args.tld,
+        date_str=args.date,
+    ):
+        if args.json:
+            results.append({"domain": domain, "file": str(file_path)})
+        else:
+            if args.verbose:
+                print(f"{domain}\t({file_path})")
+            else:
+                print(domain)
+
+    if args.json:
+        print(json.dumps(results, indent=2))
+
+    return 0
+
+
+def cmd_stats(args) -> int:
+    data_dir = Path(args.data_dir)
+    if not data_dir.exists():
+        print(f"[!] Data directory '{data_dir}' does not exist.", file=sys.stderr)
+        return 1
+
+    files = find_matching_files(data_dir)
+    print(f"[*] NetHound Database Summary: {data_dir.resolve()}")
+    print(f"    Total domain files: {len(files)}")
+
+    tld_counts: dict[str, int] = {}
+    for f in files:
+        rel = f.relative_to(data_dir)
+        tld_key = rel.parts[0]
+        if tld_key == "others" and len(rel.parts) > 1:
+            tld_key = f"others/{rel.parts[1]}"
+        try:
+            with open(f, "r", encoding="utf-8", errors="ignore") as fp:
+                count = sum(1 for line in fp if line.strip())
+            tld_counts[tld_key] = tld_counts.get(tld_key, 0) + count
+        except Exception:
+            pass
+
+    for tld_key, count in sorted(tld_counts.items(), key=lambda x: x[1], reverse=True)[:20]:
+        print(f"    - {tld_key:<15}: {count:,} domains")
+
+    print(f"    Total domains tracked: {sum(tld_counts.values()):,}")
+    return 0
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="nethound",
+        description="NetHound - Newly Registered Domains (NRDs) Tracker & Threat Intelligence Extractor",
+    )
+    parser.add_argument("-v", "--version", action="version", version=f"%(prog)s {__version__}")
+
+    subparsers = parser.add_subparsers(dest="command", help="Available subcommands")
+
+    # Fetch subcommand
+    fetch_parser = subparsers.add_parser("fetch", help="Fetch daily newly registered domains")
+    fetch_parser.add_argument(
+        "--tld",
+        default="all",
+        help="Target TLD ('in', 'com', 'all', 'others', or specific e.g. 'cn', 'shop', 'net'). Default: all",
+    )
+    fetch_parser.add_argument(
+        "--date",
+        default=None,
+        help="Date in YYYY-MM-DD or DD-MM-YYYY format (default: yesterday)",
+    )
+    fetch_parser.add_argument(
+        "-o",
+        "--output-dir",
+        default=None,
+        help="Directory to save domains (default: current directory structure)",
+    )
+    fetch_parser.add_argument(
+        "-s",
+        "--stdout",
+        action="store_true",
+        help="Stream domains directly to stdout (useful for piping into httpx, subfinder, dnsx)",
+    )
+    fetch_parser.add_argument(
+        "--json",
+        action="store_true",
+        help="Output results in JSON format",
+    )
+
+    # Search subcommand
+    search_parser = subparsers.add_parser("search", help="Search downloaded NRDs for keywords or regex")
+    search_parser.add_argument("pattern", help="String or regular expression pattern to match")
+    search_parser.add_argument("-r", "--regex", action="store_true", help="Treat pattern as regular expression")
+    search_parser.add_argument("--tld", default=None, help="Filter by specific TLD")
+    search_parser.add_argument("--date", default=None, help="Filter by specific date (YYYY-MM-DD)")
+    search_parser.add_argument("-d", "--data-dir", default=".", help="Root directory containing domain files (default: .)")
+    search_parser.add_argument("-V", "--verbose", action="store_true", help="Print file source alongside matching domain")
+    search_parser.add_argument("--json", action="store_true", help="Output results in JSON format")
+
+    # Stats subcommand
+    stats_parser = subparsers.add_parser("stats", help="Display statistics of local NRD database")
+    stats_parser.add_argument("-d", "--data-dir", default=".", help="Root directory containing domain files (default: .)")
+
+    return parser
+
+
+def main() -> int:
+    parser = build_parser()
+    args = parser.parse_args()
+
+    if not args.command:
+        parser.print_help()
+        return 0
+
+    if args.command == "fetch":
+        return cmd_fetch(args)
+    elif args.command == "search":
+        return cmd_search(args)
+    elif args.command == "stats":
+        return cmd_stats(args)
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

nethound/config.py

@@ -0,0 +1,27 @@
+import os
+from datetime import datetime
+from pathlib import Path
+
+DEFAULT_DATA_DIR = Path(os.environ.get("NETHOUND_DATA_DIR", "nethound_data"))
+
+DEFAULT_HEADERS = {
+    "User-Agent": (
+        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
+        "AppleWebKit/537.36 (KHTML, like Gecko) "
+        "Chrome/124.0.0.0 Safari/537.36 NetHound/1.0.0"
+    ),
+    "Accept": "*/*",
+}
+
+def parse_date(date_str: str | None) -> datetime:
+    """Parse a date string in YYYY-MM-DD or DD-MM-YYYY format, or default to yesterday."""
+    if not date_str:
+        from datetime import timedelta
+        return datetime.now() - timedelta(days=1)
+    
+    for fmt in ("%Y-%m-%d", "%d-%m-%Y"):
+        try:
+            return datetime.strptime(date_str, fmt)
+        except ValueError:
+            pass
+    raise ValueError(f"Invalid date format '{date_str}'. Expected YYYY-MM-DD or DD-MM-YYYY.")

nethound/fetchers/__init__.py

@@ -0,0 +1,4 @@
+from .registry_in import fetch_in_domains
+from .whoisds import fetch_whoisds_domains
+
+__all__ = ["fetch_in_domains", "fetch_whoisds_domains"]

nethound/fetchers/registry_in.py

@@ -0,0 +1,79 @@
+import io
+import re
+from datetime import datetime
+from pathlib import Path
+import requests
+
+from nethound.config import DEFAULT_HEADERS
+
+REGISTRY_IN_URL = "https://registry.in/system/files/domain-creates_{date}.pdf"
+
+
+def _extract_domains_pypdf(content: bytes) -> list[str]:
+    import pypdf
+    reader = pypdf.PdfReader(io.BytesIO(content))
+    domains = set()
+    for page in reader.pages:
+        text = page.extract_text()
+        if not text:
+            continue
+        for line in text.splitlines():
+            line = line.strip()
+            if not line or line.startswith("Domain User Form") or line.startswith("Page"):
+                continue
+            parts = line.split()
+            if parts:
+                dom = parts[0].strip().lower()
+                if "." in dom and not dom.startswith("page") and not dom.startswith("created"):
+                    domains.add(dom)
+    return sorted(domains)
+
+
+def _extract_domains_pdfplumber(content: bytes) -> list[str]:
+    import pdfplumber
+    domains = set()
+    with pdfplumber.open(io.BytesIO(content)) as pdf:
+        for page in pdf.pages:
+            table = page.extract_table()
+            if table:
+                for row in table[1:]:
+                    if row and row[0]:
+                        domain = row[0].strip().lower()
+                        if domain and domain != "domain user form" and "." in domain:
+                            domains.add(domain)
+    return sorted(domains)
+
+
+def extract_domains_from_pdf_bytes(content: bytes) -> list[str]:
+    """Extract domains from registry.in PDF bytes using pypdf or pdfplumber."""
+    try:
+        return _extract_domains_pypdf(content)
+    except ImportError:
+        pass
+
+    try:
+        return _extract_domains_pdfplumber(content)
+    except ImportError:
+        raise RuntimeError("No PDF extractor available. Please install 'python3-pypdf' or 'pdfplumber'.")
+
+
+def fetch_in_domains(target_date: datetime, output_dir: Path | None = None) -> list[str]:
+    """Download and extract .IN newly registered domains for target_date."""
+    date_formatted = target_date.strftime("%Y-%m-%d")
+    url = REGISTRY_IN_URL.format(date=date_formatted)
+
+    response = requests.get(url, headers=DEFAULT_HEADERS, timeout=45)
+    response.raise_for_status()
+
+    domains = extract_domains_from_pdf_bytes(response.content)
+
+    if output_dir:
+        year = target_date.strftime("%Y")
+        month = target_date.strftime("%m")
+        dest_dir = output_dir / "in" / year / month
+        dest_dir.mkdir(parents=True, exist_ok=True)
+        dest_file = dest_dir / f"domains_{date_formatted}.txt"
+        with open(dest_file, "w", encoding="utf-8") as f:
+            f.write("\n".join(domains) + ("\n" if domains else ""))
+
+    return domains

nethound/fetchers/whoisds.py

@@ -0,0 +1,118 @@
+import base64
+from collections import defaultdict
+from datetime import datetime
+import io
+from pathlib import Path
+import tempfile
+import zipfile
+import requests
+
+from nethound.config import DEFAULT_HEADERS
+
+WHOISDS_URL = "https://whoisds.com/whois-database/newly-registered-domains/{b64_date}/nrd"
+
+
+def download_nrd_archive(target_date: datetime) -> bytes | None:
+    """Download daily NRD zip archive from WhoisDS, with temporary caching."""
+    date_formatted = target_date.strftime("%Y-%m-%d")
+    cache_file = Path(tempfile.gettempdir()) / f"nethound_{date_formatted}.zip"
+
+    if cache_file.exists() and cache_file.stat().st_size > 1024:
+        try:
+            with open(cache_file, "rb") as f:
+                data = f.read()
+            with zipfile.ZipFile(io.BytesIO(data)) as z:
+                if z.namelist():
+                    return data
+        except Exception:
+            cache_file.unlink(missing_ok=True)
+
+    b64_filename = base64.b64encode(f"{date_formatted}.zip".encode()).decode().rstrip("=")
+    url = WHOISDS_URL.format(b64_date=b64_filename)
+
+    response = requests.get(url, headers=DEFAULT_HEADERS, timeout=60)
+    if response.status_code != 200:
+        return None
+
+    try:
+        with zipfile.ZipFile(io.BytesIO(response.content)) as z:
+            if not z.namelist():
+                return None
+    except zipfile.BadZipFile:
+        return None
+
+    with open(cache_file, "wb") as f:
+        f.write(response.content)
+
+    return response.content
+
+
+def fetch_whoisds_domains(
+    target_date: datetime,
+    tld: str = "com",
+    output_dir: Path | None = None,
+) -> dict[str, list[str]]:
+    """
+    Extract domains from WhoisDS NRD archive.
+    tld can be 'com', 'all', 'others', or a specific TLD like 'net', 'shop', 'cn'.
+    Returns a dict mapping TLD -> list of domains.
+    """
+    archive_bytes = download_nrd_archive(target_date)
+    if not archive_bytes:
+        return {}
+
+    date_formatted = target_date.strftime("%Y-%m-%d")
+    year = target_date.strftime("%Y")
+    month = target_date.strftime("%m")
+
+    tld_lower = tld.lower()
+    target_is_all = tld_lower in ("all", "*")
+    target_is_others = tld_lower == "others"
+    target_is_com = tld_lower == "com"
+
+    results: dict[str, list[str]] = defaultdict(list)
+
+    with zipfile.ZipFile(io.BytesIO(archive_bytes)) as z:
+        for filename in z.namelist():
+            with z.open(filename) as f:
+                for line in f:
+                    domain = line.decode("utf-8", errors="ignore").strip().lower()
+                    if not domain or "." not in domain:
+                        continue
+
+                    if domain.endswith(".com"):
+                        if target_is_all or target_is_com:
+                            results["com"].append(domain)
+                    else:
+                        if target_is_com:
+                            continue
+                        try:
+                            ascii_dom = domain.encode("idna").decode("ascii")
+                        except Exception:
+                            ascii_dom = domain
+
+                        parts = ascii_dom.rsplit(".", 1)
+                        if len(parts) == 2:
+                            current_tld = parts[1].lower()
+                            if current_tld.replace("-", "").isalnum():
+                                if not target_is_all and not target_is_others and current_tld != tld_lower:
+                                    continue
+                                results[current_tld].append(domain)
+
+    # Sort and deduplicate
+    for k in list(results.keys()):
+        results[k] = sorted(set(results[k]))
+
+    # Save to disk if output directory provided
+    if output_dir:
+        for current_tld, doms in results.items():
+            if current_tld == "com":
+                dest_dir = output_dir / "com" / year / month
+            else:
+                dest_dir = output_dir / "others" / current_tld / year / month
+            dest_dir.mkdir(parents=True, exist_ok=True)
+            dest_file = dest_dir / f"domains_{date_formatted}.txt"
+            with open(dest_file, "w", encoding="utf-8") as f:
+                f.write("\n".join(doms) + ("\n" if doms else ""))
+
+    return dict(results)

nethound/search.py

@@ -0,0 +1,68 @@
+import os
+import re
+from pathlib import Path
+from typing import Generator
+
+
+def find_matching_files(data_dir: Path, tld: str | None = None, date_str: str | None = None) -> list[Path]:
+    """Find domain text files matching optional TLD and date filters."""
+    matched = []
+    if not data_dir.exists():
+        return matched
+
+    for root, _, files in os.walk(data_dir):
+        for f in files:
+            if not f.startswith("domains_") or not f.endswith(".txt"):
+                continue
+            path = Path(root) / f
+
+            # Date filter check
+            if date_str and f"domains_{date_str}.txt" != f:
+                continue
+
+            # TLD filter check
+            if tld:
+                rel = path.relative_to(data_dir)
+                parts = rel.parts
+                # Structure: in/year/month/file or com/year/month/file or others/tld/year/month/file
+                if parts[0] == "in" and tld.lower() != "in":
+                    continue
+                elif parts[0] == "com" and tld.lower() != "com":
+                    continue
+                elif parts[0] == "others" and len(parts) > 1 and parts[1].lower() != tld.lower():
+                    continue
+
+            matched.append(path)
+
+    return sorted(matched)
+
+
+def search_domains(
+    data_dir: Path,
+    pattern: str,
+    regex: bool = False,
+    tld: str | None = None,
+    date_str: str | None = None,
+) -> Generator[tuple[str, Path], None, None]:
+    """
+    Search domain records for a string or regex pattern.
+    Yields (domain, file_path).
+    """
+    files = find_matching_files(data_dir, tld=tld, date_str=date_str)
+    
+    if regex:
+        compiled = re.compile(pattern, re.IGNORECASE)
+        matcher = lambda d: bool(compiled.search(d))
+    else:
+        needle = pattern.lower()
+        matcher = lambda d: needle in d.lower()
+
+    for file_path in files:
+        try:
+            with open(file_path, "r", encoding="utf-8", errors="ignore") as f:
+                for line in f:
+                    dom = line.strip()
+                    if dom and matcher(dom):
+                        yield (dom, file_path)
+        except Exception:
+            continue

nethound-1.0.0.dist-info/METADATA

@@ -0,0 +1,210 @@
+Metadata-Version: 2.4
+Name: nethound
+Version: 1.0.0
+Summary: Newly Registered Domains (NRDs) Tracker & Threat Intelligence Extractor
+Author: xploitoverload
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/xploitoverload/NetHound
+Project-URL: Repository, https://github.com/xploitoverload/NetHound.git
+Project-URL: Issues, https://github.com/xploitoverload/NetHound/issues
+Keywords: osint,threat-intelligence,nrd,security,domains,phishing-detection,pentesting
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Security
+Classifier: Intended Audience :: Information Technology
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests>=2.28.0
+Requires-Dist: pypdf>=3.0.0
+Provides-Extra: legacy-pdf
+Requires-Dist: pdfplumber>=0.10.0; extra == "legacy-pdf"
+Dynamic: license-file
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/xploitoverload/NetHound/main/assets/nethound-icon.svg" alt="NetHound wolf logo" width="180" height="180">
+</p>
+
+# NetHound 🐕
+### Newly Registered Domains (NRDs) Tracker & Threat Intelligence Engine
+
+[![Release](https://img.shields.io/badge/release-v1.0.0-blue.svg)](https://github.com/xploitoverload/NetHound/releases)
+[![Daily Domain Fetch](https://github.com/xploitoverload/NetHound/actions/workflows/daily-domain-fetch.yml/badge.svg)](https://github.com/xploitoverload/NetHound/actions/workflows/daily-domain-fetch.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](https://opensource.org/licenses/MIT)
+[![Python 3.9+](https://img.shields.io/badge/python-3.9+-blue.svg)](https://www.python.org/downloads/)
+[![Platform: Linux | macOS | Windows](https://img.shields.io/badge/platform-Linux%20%7C%20macOS%20%7C%20Windows-lightgrey.svg)](https://github.com/xploitoverload/NetHound)
+
+**NetHound** is a fast, modular CLI tool and threat intelligence engine designed to monitor, extract, and search Newly Registered Domains (NRDs) across global registries (.IN, .COM, and hundreds of top-level domains).
+
+Security teams, OSINT researchers, and penetration testers use newly registered domains to detect:
+* **Phishing campaigns** and credential harvesting setups hours after registration.
+* **Brand impersonation** and typosquatting attacks targeting organizations.
+* **Malware C2 infrastructure** and fast-flux domains before active deployment.
+
+---
+
+## ✨ Features
+
+* **Multi-Registry Tracking:** Native support for `.IN` (Registry.in), `.COM`, and hundreds of generic TLDs (`.cn`, `.shop`, `.top`, `.net`, `.xyz`, etc.).
+* **Pure Python & Fast Extraction:** Uses high-performance `pypdf` stream extraction with zero external system binaries.
+* **Built-in Search Engine:** Search through historical and daily domain lists by exact string or regular expressions (`nethound search`).
+* **Unix Pipe Friendly:** Stream domains straight to stdout (`--stdout` / `-s`) to pipe into `httpx`, `dnsx`, `subfinder`, or `nuclei`.
+* **Debian & Kali Linux Ready:** Native `debian/` packaging included out-of-the-box for inclusion in security distributions.
+
+---
+
+## 🚀 Installation
+
+### Using pip (PyPI)
+```bash
+pip install nethound
+```
+
+### From Source
+```bash
+git clone https://github.com/xploitoverload/NetHound.git
+cd NetHound
+pip install .
+```
+
+Or install directly via Git:
+```bash
+pip install git+https://github.com/xploitoverload/NetHound.git
+```
+
+### Debian / Kali Linux Package Build
+```bash
+sudo apt install -y dh-python python3-all python3-requests python3-pypdf
+cd NetHound
+dpkg-buildpackage -us -uc -b
+sudo dpkg -i ../nethound_1.0.0*.deb
+```
+
+---
+
+## 🛠️ Usage
+
+### 1. Fetching Domains (`nethound fetch`)
+
+Fetch all domains from yesterday across all supported registries:
+```bash
+nethound fetch --tld all
+```
+
+Fetch only `.IN` newly registered domains for a specific date:
+```bash
+nethound fetch --tld in --date 2026-11-01
+```
+
+Fetch only `.COM` domains:
+```bash
+nethound fetch --tld com --date 2026-11-01
+```
+
+Fetch specific TLD (e.g. `.cn` or `.shop`):
+```bash
+nethound fetch --tld cn --date 2026-11-01
+```
+
+#### Pipeline Integration (Piping to Security Tools)
+Stream domain names directly to standard output without status logs:
+```bash
+# Check live HTTP services on today's .in registrations
+nethound fetch --tld in -s | httpx -silent -title -status-code
+
+# Resolve DNS records for newly registered .com domains
+nethound fetch --tld com -s | dnsx -silent -a -resp
+```
+
+Output as structured JSON:
+```bash
+nethound fetch --tld in --json
+```
+
+---
+
+### 2. Searching NRD Records (`nethound search`)
+
+Search for keyword occurrences (e.g., brand monitoring for "paypal" or "bank"):
+```bash
+nethound search "paypal"
+```
+
+Search with Regular Expressions (`-r` / `--regex`):
+```bash
+nethound search -r "^login.*\.com$"
+```
+
+Filter search by specific TLD:
+```bash
+nethound search "binance" --tld com
+```
+
+Print source files and line locations:
+```bash
+nethound search "kali" -V
+```
+
+---
+
+### 3. Database Statistics (`nethound stats`)
+
+View a statistical summary of all currently tracked domains and file distributions:
+```bash
+nethound stats
+```
+
+---
+
+## 📂 Repository Data Structure
+
+For researchers interested in automated historical archives, domain lists are structured as follows:
+
+```text
+NetHound/
+├── in/                          # .IN Registry creations (yearly/monthly)
+│   └── 2026/
+│       └── 11/
+│           └── domains_2026-11-01.txt
+├── com/                         # .COM Newly Registered Domains
+│   └── 2026/
+│       └── 11/
+│           └── domains_2026-11-01.txt
+├── others/                      # Sub-partitioned per TLD
+│   ├── cn/
+│   ├── shop/
+│   ├── top/
+│   └── ...
+├── nethound/                    # Core Python package
+│   ├── cli.py                   # Main CLI entrypoint
+│   ├── config.py                # Configurations & date parsers
+│   ├── search.py                # Search and regex engine
+│   └── fetchers/                # Registry & WhoisDS extraction engines
+├── debian/                      # Official Debian/Kali packaging files
+└── .github/workflows/           # Automated daily sync pipeline
+```
+
+---
+
+## 🤖 Automated Daily Synchronization
+
+NetHound runs an automated GitHub Action every morning at **09:00 AM IST (03:30 UTC)** to fetch, extract, and index all newly registered domain drops from global registries.
+
+---
+
+## 🛡️ License
+
+This project is licensed under the [MIT License](LICENSE).
+
+---
+
+## 👤 Author
+
+Developed by **[xploitoverload](https://github.com/xploitoverload)**.  
+Contributions, issues, and feature requests are welcome!
+
+---
+
+<p align="center">
+  <img src="NetHound%20Cybersecurity%20Intelligence%20Banner.png" alt="NetHound Cybersecurity Intelligence Banner" width="100%">
+</p>

nethound-1.0.0.dist-info/RECORD

@@ -0,0 +1,13 @@
+nethound/__init__.py,sha256=1fAfR3TMVbo0x3J2F9JwNtekACmpE4ESQTzaKPDrY3I,165
+nethound/cli.py,sha256=GjBDUSb-eYRL-R6LwNUJ5vbm5Dlj0SXmixrnd7F0RpU,7603
+nethound/config.py,sha256=2q__6gsaLd1dmhZ3lFsyHDRxnDp_CAb-Pm6Q8a_2evQ,875
+nethound/search.py,sha256=Q63Zhj5TwSxPWEt5tOm3c1hcLEaYFmBOk5zk9EXYll0,2168
+nethound/fetchers/__init__.py,sha256=X_RO4pix7OzDmqaam5ZaARvxi7YmKlPf9uvuNQudll4,142
+nethound/fetchers/registry_in.py,sha256=m8vBgMTh-KY5YjOK17Mq7oVAUM59_t1vwfPunQffmT4,2760
+nethound/fetchers/whoisds.py,sha256=hc8dteGFaO7Wd0T32-70y_endV9afK1pEFCFJhrXCTs,4229
+nethound-1.0.0.dist-info/licenses/LICENSE,sha256=4bx5FyT-vtUhr5IE87q5MVlspNCAFmmRZDHpP7RNQLU,1071
+nethound-1.0.0.dist-info/METADATA,sha256=0r2FKwIqfLlu8ZKjntBDg5HgoAm-CesA019FZANn9Ic,6904
+nethound-1.0.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+nethound-1.0.0.dist-info/entry_points.txt,sha256=hLOcDkbJR_6-r2NnW-b08BPGGO63WUYRxe9Y8Hwsnjc,47
+nethound-1.0.0.dist-info/top_level.txt,sha256=irA2SGu-9dWDQC1Dj9IZQPnxeoLpIvljzc0dodDNugY,9
+nethound-1.0.0.dist-info/RECORD,,

nethound-1.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

nethound-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+nethound = nethound.cli:main

nethound-1.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 xploitoverload
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

nethound-1.0.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+nethound