skills.rest
519lab
519labOFFICIAL
Explore all skills by this author →
WebsiteGitHub

domain-intel

Perform passive domain reconnaissance using Python's standard library.

2|Updated May 22, 2026
Search Tags:#domain reconnaissance#subdomain discovery#ssl certificate#whois lookup#passive osint
One-click install
npx skills add https://github.com/519lab/thoth-agent --skill domain-intel-519lab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/519lab/thoth-agent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/519lab/thoth-agent --skill domain-intel-519lab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill addresses the need for passive domain reconnaissance, allowing users to gather domain intelligence without relying on external APIs or requiring API keys.

Core Features & Use Cases

  • Subdomain Discovery: Identify subdomains using Certificate Transparency logs.
  • SSL Certificate Inspection: Examine SSL certificate details such as expiry, cipher, and SANs.
  • WHOIS Lookup: Retrieve registration information from WHOIS servers.
  • DNS Records: Resolve and analyze DNS records.
  • Domain Availability Check: Determine the availability of a domain using passive signals.
  • Use Case: For cybersecurity professionals or IT administrators to assess the infrastructure of potential targets or to monitor their own domains for any unusual activities.

Quick Start

To find subdomains of 'example.com', use the domain-intel skill with the command: domain-intel subdomains example.com.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains without using external API keys?▼

You can discover subdomains without API keys by querying Certificate Transparency logs. This passive reconnaissance approach identifies subdomains using built-in network libraries, avoiding external dependencies.

How do I perform a WHOIS lookup and DNS resolution using only Python's standard library?▼

WHOIS lookups and DNS resolution can be performed passively using Python's standard library. The skill retrieves registration information from WHOIS servers and resolves DNS records without requiring third-party modules.

Can I check SSL certificate details like expiry and SANs for a domain?▼

Yes, SSL certificate inspection extracts details like expiry dates, ciphers, and Subject Alternative Names. This passive analysis helps assess domain infrastructure security without needing API access.

What is passive domain reconnaissance and when do I need it for security auditing?▼

Passive domain reconnaissance gathers intelligence on domain infrastructure without direct interaction or API keys. It is ideal for security auditing and infrastructure monitoring to assess potential targets or detect unusual activities.

Are there limitations to passive OSINT for checking domain availability?▼

Domain availability checks using passive OSINT rely on indirect signals rather than real-time registrar queries. This approach avoids API keys but may lack immediate accuracy for domains in pending registration states.

Related Skills

Explore More Software Engineering Skills→
aayushsoamaayushsoam
1

domain-intel

Perform passive domain reconnaissance using Python stdlib without API keys.

Community
Intermediate
GregsGreyCodeGregsGreyCode
6

domain-intel

Find subdomains, SSL certificates, WHOIS, and DNS records using Python's standard library.

Community
Intermediate
zebbernzebbern
5

subdomain-enum

Enumerate subdomains with Subfinder, Amass, and Httpx pipelines.

Community
Advanced
auxi-wardrobeauxi-wardrobe
1

cti-expert

Conduct structured cyber threat intelligence and OSINT analysis on target entities.

Official
Advanced