skills.rest
ex3ndr
ex3ndrCOMMUNITY
Explore all skills by this author →
Website𝕏@ex3ndrGitHub

domain-intel

Gathers subdomains, SSL certificate details, WHOIS records, and DNS info for a domain via passive reconnaissance.

14|2|Updated Jan 30, 2026
Search Tags:#reconnaissance#dns#ssl#domain#osint#whois
One-click install
npx skills add https://github.com/ex3ndr/daycare --skill domain-intel-ex3ndr
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/ex3ndr/daycare/tree/main/packages/daycare/sources/skills/research/domain-intel
Command: npx skills add https://github.com/ex3ndr/daycare --skill domain-intel-ex3ndr

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill automates passive domain reconnaissance, gathering crucial intelligence about a domain's online presence without active probing.

Core Features & Use Cases

  • Subdomain Discovery: Identifies subdomains using Certificate Transparency logs.
  • SSL Certificate Analysis: Checks SSL certificate expiry, issuer, and details.
  • WHOIS & DNS Records: Retrieves domain registration information and DNS records.
  • Availability Heuristics: Provides an indication of domain availability.
  • Use Case: Before acquiring a new domain, use this Skill to quickly assess its existing digital footprint, identify potential security risks via SSL expiry, and understand its registration history.

Quick Start

Run the domain-intel skill to get the subdomains, SSL details, and WHOIS information for example.com.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without active probing?▼

Passive domain reconnaissance gathers subdomains via crt.sh, inspects SSL certificates, and queries WHOIS records to analyze a domain's online presence without sending direct probes to the target.

What is the best way to find subdomains using Certificate Transparency logs?▼

Finding subdomains with Certificate Transparency logs involves querying crt.sh to identify issued certificates, which reveals subdomain names associated with the target domain.

How can I check SSL certificate expiry and details for a domain?▼

Checking SSL certificate details involves inspecting the certificate to retrieve its expiration date, issuer information, and other configuration details to identify potential security risks.

Can I retrieve WHOIS and DNS records to assess a domain before acquisition?▼

Retrieving WHOIS and DNS records provides domain registration information and current DNS configurations, allowing you to understand the registration history and digital footprint of a domain before acquiring it.

Does passive reconnaissance provide an indication of domain availability?▼

Passive reconnaissance provides heuristic availability checks for domains by analyzing gathered DNS records and registration data to estimate whether a domain is currently registered and active.

Related Skills

Explore More Software Engineering Skills→
Steffen025Steffen025
186

Recon

Automate passive and authorized active infrastructure reconnaissance across domains, IPs, netblocks, and ASNs.

Community
Advanced
dawsonblockdawsonblock

domain-intel

Perform subdomain discovery, SSL, WHOIS, DNS, and availability checks using Python stdlib.

Community
Intermediate
L3DigitalNetL3DigitalNet
6

nmap

Scan networks for hosts, ports, services, and operating systems using nmap.

Official
Intermediate
GratefulJinx77GratefulJinx77

Recon

Perform passive and active network reconnaissance using WHOIS, DNS, and OSINT.

Community
Advanced