skills.rest
chenchunrun
chenchunrunCOMMUNITY
Explore all skills by this author →
GitHub

domain-analysis

Aggregate WHOIS, DNS, DGA, homograph, CDN, and ICP data to assess domain risk.

1|1|Updated Apr 25, 2026
Search Tags:#dns#whois#threat-intelligence#domain-analysis#homograph#dga
One-click install
npx skills add https://github.com/chenchunrun/onyx-soc --skill domain-analysis-chenchunrun
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-analysis
Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/domain-analysis
Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill domain-analysis-chenchunrun

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python-whois, dnspython, and includes scripts (resource) and references (resource) components.

What problem does it solve?

本技能对域名威胁进行综合分析，聚合 WHOIS 数据、域名年龄风险、DNS 记录、DGA 指标、同形字、CDN 存在与 ICP 备案状态等信息，以评估域名风险。作为对域名信息的权威来源，url-analysis 等技能在需要获取注册信息时应调用本技能进行查询，以便快速判断域名的安全性、检测可疑域名或评估钓鱼风险。

Core Features & Use Cases

  • 域名信息整合: 汇聚 WHOIS、年龄、DNS、DGA、同形字检测、CDN/ICP 状态，形成统一的威胁画像。
  • 快速与深度分析: 支持快速排查与深入调查，适用于日常监控和现场取证场景。
  • 典型用例: 对新观察到的域名进行注册信息核验、威胁情报整合、并输出可执行处置建议。

Quick Start

Analyze a domain like example.com to generate a comprehensive threat report.

Frequently Asked Questions about domain-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I assess domain threat intelligence and check if a domain is safe?▼

Assess domain threat intelligence by aggregating WHOIS data, domain age, DNS records, DGA signals, homograph indicators, CDN presence, and ICP status to produce a structured risk score and actionable recommendations.

What is DGA detection and how does homograph detection identify suspicious domains?▼

DGA detection identifies algorithmically generated domains often used by malware, while homograph detection spots lookalike domains using mixed character sets to spoof legitimate websites and facilitate phishing.

How do I perform a quick domain risk assessment for phishing analysis?▼

Perform a quick domain risk assessment by querying the domain to aggregate registration data, DNS configurations, and threat indicators, generating a quick-look risk profile for immediate phishing analysis.

Does python-whois support querying international domain ICP status and CDN presence?▼

Python-whois queries generic registration data, while local analysis modules separately check ICP filing status and CDN presence to evaluate domain infrastructure and regional compliance risks.

What's the best way to investigate a newly registered domain's WHOIS history and age risk?▼

Investigate newly registered domains by extracting WHOIS creation dates and registrant history through local analysis modules to calculate domain age risk and flag suspicious recent registrations.

When should I not rely solely on local DNS and WHOIS data for domain risk analysis?▼

Avoid relying solely on local data during sophisticated attacks where external context is critical; integrate optional MCP threat intelligence to uncover hidden infrastructure and advanced persistent threats.

Related Skills

Explore More Data & Analytics Skills→
GhostPWNGhostPWN
4

Reconnaissance & OSINT Automation

Map external attack surfaces by discovering subdomains, DNS records, and web technology fingerprints.

Official
Advanced
claude-office-skillsclaude-office-skills
368

Security Monitoring

Automate security monitoring, threat detection, and incident response workflows.

Official
Advanced
4lerman4lerman

threat-detection

Score hunting hypotheses against MITRE ATT&CK techniques and IOC data.

Community
Advanced
founderphantomfounderphantom

domain-intel

Gather passive domain intelligence using Python's standard library.

Community
Advanced