skills.rest
devMoez
devMoezCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Collect subdomains, DNS records, TLS certificates, and WHOIS data into JSON.

1|Updated May 16, 2026
Search Tags:#domain reconnaissance#osint#domain availability#whois#subdomains#dns records#tls certificate
One-click install
npx skills add https://github.com/devMoez/titan --skill domain-intel-devmoez
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/devMoez/titan/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/devMoez/titan --skill domain-intel-devmoez

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

You need fast, reliable visibility into a domain’s infrastructure (subdomains, DNS records, TLS certificate details, and registration signals) without manually juggling multiple websites and tools.

Core Features & Use Cases

  • Passive domain reconnaissance: Collects subdomains from Certificate Transparency logs, TLS certificate metadata from port 443, DNS records via system DNS plus Google DoH, and WHOIS registration signals.
  • Availability-oriented assessment: Combines DNS, WHOIS, and SSL reachability into a heuristic verdict for “likely available” vs “registered/in use,” useful when evaluating new domains.
  • Bulk multi-domain analysis: Runs multiple checks across multiple domains in parallel and returns structured JSON for downstream workflows.

Quick Start

Ask the agent to run domain intelligence for example.com and return subdomains, DNS records, TLS certificate expiry details, and WHOIS registration signals in JSON format.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without API keys?▼

Passive domain reconnaissance collects subdomains from Certificate Transparency logs, TLS metadata from port 443, DNS records via system DNS and Google DoH, and WHOIS data via TCP:43 without API keys.

Can I check domain availability using DNS and WHOIS signals?▼

Domain availability checking combines DNS resolution, WHOIS registration signals, and SSL reachability into a heuristic verdict to determine if a domain is likely available or registered and in use.

How do I find subdomains using certificate transparency logs?▼

Finding subdomains uses certificate transparency logs via crt.sh over HTTPS to passively collect published subdomains for a target domain without active scanning or authentication.

What's the best way to run bulk domain analysis for infrastructure due diligence?▼

Bulk domain analysis runs multiple checks across multiple domains in parallel, returning structured JSON containing subdomains, DNS records, TLS certificate details, and WHOIS registration signals for downstream workflows.

Do I need Python packages to retrieve TLS certificate and DNS records?▼

Retrieving TLS certificates and DNS records requires only Python-stdlib-only execution, using system DNS and Google DoH for DNS resolution and TCP:443 for TLS inspection without external package dependencies.

Related Skills

Explore More Education & Research Skills→
sgcarstrendssgcarstrends
21

domain-management

Configure Cloudflare DNS and SSL certificates for sgcarstrends.com subdomains.

Official
Advanced
alexhegitalexhegit
4

due-diligence-analyst

Generate structured company profiles, quick DD reports, and risk assessments.

Community
Intermediate
Quill-AgentQuill-Agent
3

domain-intel

Perform passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS, DNS records, and availability checks.

Community
Advanced
protoLabsAIprotoLabsAI
2

recon-sweep

Perform passive and scoped active reconnaissance on network targets and domains.

Official
Advanced