MKIDomain Recon

Changelog

Development started May 30, 2026/First release June 1, 2026

A serverless application for domain investigation and continuous monitoring, built on the WhoisXML API.

Architecture

Internet（公開ネットワーク）利用者ブラウザ（PC / スマホ）Cron Worker毎日 JST 8時に発火お名前.com（DNS）mkilabo.com の Zone 管理recon → Cloudflare に CNAMEEntra ID + MFA（@mkilabo.com アカウントのみ）Service Token（Cron Worker 専用）DNS 解決のみ（リクエストは Cloudflare 経由）─── 認証境界 ───ここから内側は認証を通過したリクエストのみ到達可Cloudflare AccessIdP: @mkilabo.com の Entra ID + MFAService Auth: Cron Worker の Service TokenPages（Edge Runtime / Next.js）Edge プロキシ群 + 監視ロジックCloudflare KV監視リスト / snapshot検知ログ差分検知snapshot 比較検知ログ追加WhoisXML APIWHOIS / DNS / DRSGitHubsuminot/mki-drs-toolpush で自動 build / deployビルド & デプロイ（runtime 経路とは別）格納情報の原則OSINT / ASM データに限定（秘密・機密情報は含まない）WHOIS / DNS / サブドメイン等の公開情報および差分検知履歴のみ

Security and stored data

  • No direct access from the public internet: every request, browser or worker, transits through Cloudflare Access.
  • Identity-based access limited to Entra ID accounts under @mkilabo.com (MFA required).
  • Machine-to-machine access (the daily Cron Worker) goes through a dedicated Service Token allowed only for the cron-check endpoint.
  • Stored data is strictly OSINT / ASM material (WHOIS, DNS, subdomain observations, and the resulting change log). No secrets, no customer-confidential information.
  • API keys, Service Token client secrets, and similar credentials are kept only in Cloudflare environment secrets, never in source.

Serverless platform

  • Edge-native build on Cloudflare Pages (Next.js / Edge Runtime).
  • No always-on server. All state consolidated in Cloudflare KV.
  • Edge proxy routes for the WhoisXML API (22 routes).
  • mkilabo.com DNS managed on onamae.com; only the recon.mkilabo.com CNAME points at Cloudflare.
  • Source on GitHub (suminot/mki-drs-tool); pushes trigger automatic build and deploy on Cloudflare Pages.

Zero-trust authentication

  • Authentication boundary built on Cloudflare Access + Entra ID + MFA.
  • Access limited to @mkilabo.com accounts.
  • Served only through the custom domain recon.mkilabo.com, never exposing pages.dev externally.
  • New pages.dev subdomains can be flagged by internal-network filtering; consolidating traffic to the custom domain avoids this.
  • Foundation for machine-to-machine authentication via Service Tokens.

Continuous domain monitoring

  • Registration of monitored domains, with WHOIS / DNS snapshots persisted to KV.
  • Diff detection against the previous snapshot, with a detection log in KV.
  • Manual checks (single or all-at-once) from the UI.

Scheduled execution

  • A separate Cron Worker fires daily at 08:00 JST.
  • Crosses the authentication boundary via a Service Token (machine-to-machine).
  • Auto check can be toggled on / off from the Settings page.

Investigation and intelligence

  • Domain lookup and IP lookup split into separate sections; per-API checkboxes pick what to call.
  • 11 trial-credit APIs integrated (threat intelligence, email verification, and more).
  • Per-API credit pool identified empirically so consumption lands in the right plan.

UI and output

  • Dark / light theme switch with design tokens centralising the palette.
  • Full bilingual support (Japanese / English).
  • Responsive mobile support (hamburger drawer sidebar).
  • JSON / CSV download of lookup results (individual and batch).