skills.rest
aayushsoam
aayushsoamCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Perform passive domain reconnaissance using Python stdlib without API keys.

1|1|Updated May 25, 2026
Search Tags:#domain reconnaissance#subdomain discovery#DNS records#domain availability#WHOIS lookup#SSL certificate inspection
One-click install
npx skills add https://github.com/aayushsoam/clawbot-agent --skill domain-intel-aayushsoam
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/aayushsoam/clawbot-agent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/aayushsoam/clawbot-agent --skill domain-intel-aayushsoam

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill provides passive domain reconnaissance capabilities, enabling users to gather domain intelligence without the need for API keys or external dependencies.

Core Features & Use Cases

  • Subdomain Discovery: Find subdomains using Certificate Transparency logs.
  • SSL Certificate Inspection: Check SSL certificate details such as expiry, cipher, and SANs.
  • WHOIS Lookup: Retrieve domain registration information from WHOIS servers.
  • DNS Records: Resolve DNS records including A, AAAA, MX, NS, TXT, and CNAME.
  • Domain Availability Check: Check if a domain is registered using passive signals.
  • Bulk Analysis: Run multiple checks on multiple domains in parallel.
  • Use Case: Use this Skill to perform a comprehensive security audit on a set of domains, including identifying potential vulnerabilities and gathering intelligence on domain ownership and history.

Quick Start

Run the domain-intel skill with the command 'domain-intel.py bulk example.com github.com google.com'.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without API keys?▼

Passive domain reconnaissance without API keys is achieved by using Python stdlib to query Certificate Transparency logs, WHOIS servers, and DNS records to gather subdomains, SSL certificates, and registration details.

How do I find subdomains using Certificate Transparency logs?▼

Finding subdomains using Certificate Transparency logs involves querying public CT log data to enumerate subdomains passively. This Skill retrieves these records without requiring external API keys or active network scanning.

Can I check SSL certificate details and DNS records for multiple domains in bulk?▼

Checking SSL certificate details and DNS records for multiple domains in bulk is supported. You can run parallel checks across multiple domains to retrieve A, AAAA, MX, NS, TXT records, and SSL expiry data.

Do I need external dependencies to retrieve WHOIS information and check domain availability?▼

No external dependencies are needed to retrieve WHOIS information and check domain availability. This Skill operates entirely using the Python standard library to query WHOIS servers and passive signals.

What is the best way to gather domain intelligence for a security audit?▼

The best way to gather domain intelligence for a security audit is to run comprehensive passive checks. This Skill identifies subdomains, SSL configurations, and DNS records to pinpoint potential vulnerabilities and domain ownership history.

Are there limitations to passive domain reconnaissance for identifying subdomains?▼

Limitations of passive domain reconnaissance include missing subdomains that lack SSL certificates or CT log entries. Active brute-forcing or network scanning is required to find unindexed internal subdomains.

Related Skills

Explore More Software Engineering Skills→
Steffen025Steffen025
186

Recon

Automate passive and authorized active infrastructure reconnaissance across domains, IPs, netblocks, and ASNs.

Community
Advanced
ever-oliever-oli
3

domain-intel

Collect passive domain intelligence via subdomains, SSL, WHOIS, DNS, and availability.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
AissenLiuAissenLiu

domain-intel

Extract domain intelligence via passive OSINT with Python stdlib, outputting JSON.

Community
Advanced