DNeyeS

DNS Recon Tool — enumerate subdomains, resolve DNS records, inspect ASN/organization info, and hunt for the real origin IP behind proxies/CDNs (Cloudflare, TCPShield, Akamai, DDoS-Guard, and more).

⚠️ For authorized security testing and educational use only. Only scan domains you own or have explicit permission to test. You are responsible for how you use this tool.

---

Features

• Subdomain enumeration from a built-in list (or your own wordlist)
• A / AAAA / CNAME / MX / TXT record resolution
• IP → ASN / organization / geolocation lookup (via ipinfo.io)
• Proxy / CDN detection against a curated list of known providers
• Optional port scanning
• Advanced real-IP hunting:
  • SPF record IP extraction
  • MX record IP inspection
  • TLS certificate SAN discovery
  • Certificate Transparency logs (crt.sh)
• Colored terminal output + JSON and Markdown reports

---

Installation (Linux & macOS)

git clone https://github.com/im-nymii/dneyes/
cd dneyes
./install.sh

The installer will:

1. Create a virtual environment (venv/)
2. Install dependencies (dnspython, requests)
3. Create a global dneyes command in /usr/local/bin (or ~/.local/bin)

If ~/.local/bin isn't on your PATH, add this to your shell profile (~/.zshrc or ~/.bashrc):

export PATH="$HOME/.local/bin:$PATH"

The installer targets Linux and macOS only (not Windows).

Manual install

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
python dneyes.py

---

Usage

dneyes [domain] [options]

Running dneyes with no arguments launches interactive mode (prompts for the target domain and thread count).

Options

Flag	Long form	Description
domain		Target domain (positional)
-t	--threads	Number of threads (max 50)
-qs	--quick-start	Skip the banner and prompts, launch instantly (requires a domain)
-ps	--port-scan	Enable port scanning (disabled by default)
-w	--wordlist	Path to a custom subdomain wordlist (.txt), replaces the built-in list

Examples

# Interactive mode with banner
dneyes

# Instant launch, no banner
dneyes -qs example.com

# Instant launch with port scanning and 40 threads
dneyes -qs example.com -ps -t 40

# Use a custom wordlist
dneyes -qs example.com -w subdomains.txt

---

Wordlist format

A plain-text .txt file, one subdomain label per line (empty lines are ignored):

www
mail
api
panel
play

If no wordlist is provided, the built-in list is used. A non-.txt file will produce an error.

---

Output

Two reports are written next to the script after each run:

• report.json — full structured results
• report.md — human-readable Markdown report

---

Requirements

• Python 3.9+
• dnspython
• requests