Pasive OSINT subdomain

subdo_with_ptrarchive.sh

#!/bin/bash

if [ "$1" == "-h" ] || [ "$1" == "--help" ] || [[ $# -eq 0 ]]
  then
    me=`basename "$0"`
    echo "Find subdomains in PTR-archive http://ptrarchive.com/tools/search.htm?date=ALL&label=example.com"
    echo -e "Usage:\n\t./${me} [domain]"
    echo -e "Example:\n\t./${me} example.com"
    echo -e "\t./${me} -v example.com # Verbose output, includes IPs."
    exit 1
fi

if [ "$1" == "-v" ] || [ "$1" == "--verbose" ]
    then
    curl http://ptrarchive.com/tools/search3.htm\?label\=$2\&date\=ALL 2>/dev/null | grep -P '^\d+\.\d+\.\d+\.\d+'
    exit 1
fi

curl http://ptrarchive.com/tools/search3.htm\?label\=$1\&date\=ALL 2>/dev/null | grep -oP '(?<=\] ).*?(?= \[)' | sort | uniq