skills.rest
afel6
afel6COMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Identify subdomains, SSL details, WHOIS data, DNS records, and domain availability via passive OSINT.

Updated Mar 25, 2026
Search Tags:#dns#ssl#osint#bulk#whois#subdomains#domain-intel
One-click install
npx skills add https://github.com/afel6/scal-ai-pipeline --skill domain-intel-afel6
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/afel6/scal-ai-pipeline/tree/main/hermes_skills_library/optional-skills/research/domain-intel
Command: npx skills add https://github.com/afel6/scal-ai-pipeline --skill domain-intel-afel6

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance is automated to reduce manual OSINT tasks and data gathering overhead.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs (crt.sh)
  • SSL certificate inspection (expiry, issuer, SANs)
  • WHOIS lookup (registrar, dates, name servers)
  • DNS records resolution (A/AAAA/MX/NS/TXT/CNAME)
  • Domain availability signals (passive indicators)
  • Bulk analysis for multiple domains
  • Output is structured JSON for workflow integration

Quick Start

Run the domain-intel script to scan a single domain or multiple domains and return JSON results.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I gather passive OSINT data like subdomains and DNS records for a target domain?▼

To gather passive OSINT data, you query Certificate Transparency logs for subdomains, resolve DNS records, and fetch WHOIS data. This Skill automates those steps and returns structured JSON for easy workflow integration during infrastructure reconnaissance.

Can I retrieve SSL certificate details and WHOIS data in bulk for multiple domains?▼

Yes, bulk analysis for multiple domains is supported. The Skill retrieves SSL certificate details like expiry and issuer, alongside WHOIS registrar data, outputting everything as structured JSON for domain portfolio security audits.

Do I need external API keys to perform domain intelligence and subdomain discovery?▼

No external API keys are required to perform domain intelligence and subdomain discovery. The Skill implements Python stdlib-based operations, pulling subdomains from crt.sh and resolving DNS without external dependencies.

What is the best way to check domain availability signals during a competitive intelligence audit?▼

The best way to check domain availability signals during a competitive intelligence audit is to automate passive OSINT queries. This Skill retrieves passive indicators and DNS records to assess infrastructure without active probing.

How does Certificate Transparency log querying work for discovering subdomains?▼

Querying Certificate Transparency logs works by searching public CT logs, specifically crt.sh, to find historical SSL certificates issued for a domain. SANs within these certificates reveal associated subdomains for reconnaissance.

Related Skills

Explore More Data & Analytics Skills→
aayushsoamaayushsoam
1

domain-intel

Perform passive domain reconnaissance using Python stdlib without API keys.

Community
Intermediate
JKhyroJKhyro

domain-intel

Map passive domain intelligence via subdomain, SSL, WHOIS, and DNS lookups.

Community
Intermediate
heysuhasheysuhas
2

domain-intel

Perform passive domain reconnaissance using standard Python libraries.

Community
Intermediate
zli5460zli5460
2

domain-intel

Perform passive OSINT domain analysis using DNS, WHOIS, SSL, and certificate transparency logs.

Community
Basic