domain-intel

Identify subdomains, SSL data, WHOIS, DNS records, and domain availability for domains.

2|Updated Apr 25, 2026

Search Tags:#dns #ssl #osint #bulk #whois #domain-intel #passive

Ready to run

npx skills add https://github.com/AlexiosBluffMara/mercury --skill domain-intel-alexiosbluffmara

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/AlexiosBluffMara/mercury/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/AlexiosBluffMara/mercury --skill domain-intel-alexiosbluffmara

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance using Python stdlib to identify subdomains, inspect SSL certificates, fetch WHOIS data, resolve DNS records, and assess domain availability without requiring API keys.

Core Features & Use Cases

Subdomain discovery via Certificate Transparency logs
SSL certificate inspection (expiry, cipher, SANs, issuer)
WHOIS lookups (registrar, dates, name servers)
DNS records (A, AAAA, MX, NS, TXT, CNAME)
Domain availability analysis using DNS + WHOIS + SSL signals
Bulk analysis across multiple domains

Quick Start

Run the domain_intel.py CLI on a domain to obtain a JSON report containing subdomains, ssl info, whois, dns, and availability signals.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform passive domain reconnaissance without using external API keys?▼

Passive domain reconnaissance is achievable using only the Python standard library to query Certificate Transparency logs, DNS records, and WHOIS data without requiring any external API keys.

Can I run bulk WHOIS and DNS lookups across multiple domains?▼

Yes, bulk WHOIS and DNS lookups can be run across multiple domains simultaneously. The script processes batches of domains to extract registrar details, name servers, and record types like A, MX, and TXT into structured JSON outputs.

How do I find subdomains using Certificate Transparency logs in Python?▼

Subdomains are discovered by querying Certificate Transparency logs via Python stdlib. This passive OSINT technique extracts Subject Alternative Names and certificate data to enumerate subdomains without active scanning.

Does Python standard library support fetching SSL certificate expiry and issuer data?▼

Python standard library supports fetching SSL certificate data including expiry dates, cipher information, and issuer details. This deterministic inspection works without external dependencies or API authentication keys.

What is the best way to check domain availability using DNS and WHOIS signals?▼

Domain availability analysis is checked by combining DNS resolution, WHOIS registration data, and SSL certificate signals. This passive approach assesses whether a domain is registered and active without active network scanning.

What are the limitations of passive OSINT domain intelligence?▼

Passive OSINT domain intelligence limitations include reliance on publicly available data like Certificate Transparency logs and standard DNS queries. It avoids active scanning, meaning it may miss unlisted subdomains or firewall-protected internal records.