uh-recon-raw-to-domains

#!/usr/bin/python3
# Turn raw output from Shodan search into
# sorted list of TLDs, by frequency
# 2024/gad

import sys
from collections import Counter

# Check for input file argument
if len(sys.argv) != 2:
  print ("Wrong! python3 %s <shodan_raw_output>" % (sys.argv[0]))
  sys.exit(1)

sInfile = sys.argv[1]

# Grep-out domain-ish strings from 3rd column
aDomains = []
with open (sInfile) as f:
  for line in f:
    parts = line.split()
    if len(parts) > 2:  # Ensure 3rd col else Python freaks
      domain_parts = parts[2].split('.')
      if len(domain_parts) >= 2 and len(domain_parts[-1]) > 1:
        domain = '.'.join(domain_parts[-2:])   # Extract top-level domain

        # if domain.isalnum() or '-' in domain:  # Basic domain validation
        aDomains.append(domain)

# Count occurrences and sort by frequency
domain_counts = Counter(aDomains)
for domain, count in domain_counts.most_common():
  print (f"{count} {domain}")