skills.rest
founderphantom
founderphantomCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Gather passive domain intelligence using Python's standard library.

Updated Apr 1, 2026
Search Tags:#dns#osint#whois#subdomains#python-stdlib#domain-intel#passive-recon
One-click install
npx skills add https://github.com/founderphantom/zola-agent --skill domain-intel-founderphantom
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/founderphantom/zola-agent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/founderphantom/zola-agent --skill domain-intel-founderphantom

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance often requires external services or exhaustive manual checks; this skill provides a zero-dependency way to gather essential OSINT data for a domain using only Python's standard library.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs (crt.sh) to map domain surface.
  • SSL/TLS inspection for certificate validity, expiry, issuer, and cipher details.
  • WHOIS lookups to retrieve registration data and DNS information.
  • DNS records resolution (A, AAAA, MX, NS, TXT, CNAME) via system DNS and DoH.
  • Domain availability heuristics combining DNS, WHOIS, and TLS signals to assess usage.

Quick Start

Run the domain_intel.py CLI with a target domain to perform the chosen checks.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance using only Python's standard library?▼

Passive domain reconnaissance can be performed using pure Python stdlib by querying Certificate Transparency logs, WHOIS databases, and DNS servers, returning structured JSON without needing external dependencies. This allows subdomain discovery, SSL inspection, and DNS resolution directly.

How do I find subdomains for a domain using Certificate Transparency logs?▼

Subdomains are discovered by querying crt.sh Certificate Transparency logs to map the target domain's external surface. This passive OSINT technique enumerates issued SSL certificates to reveal subdomains without actively scanning the target network infrastructure.

Can I check domain availability using DNS, WHOIS, and TLS signals without external packages?▼

Domain availability is determined through heuristics combining DNS resolution, WHOIS registration data, and TLS certificate signals. This pure Python stdlib approach assesses whether a domain is actively in use or potentially available for registration.

How do I resolve DNS records like A, MX, and TXT using Python?▼

DNS records such as A, AAAA, MX, NS, TXT, and CNAME are resolved using Python's standard library via system DNS and DNS over HTTPS. This returns structured JSON containing the target domain's complete DNS configuration and mail server routing.

What is the best way to run bulk multi-domain OSINT analysis?▼

Bulk multi-domain analysis is executed by running the Python CLI in bulk mode, processing multiple target domains simultaneously. It aggregates passive OSINT data including WHOIS, DNS, SSL, and subdomain discovery into a unified structured JSON output.

Does this passive OSINT approach work for SSL certificate inspection and expiry checks?▼

SSL and TLS inspection is supported natively, checking certificate validity, expiry dates, issuer details, and cipher information. This passive recon method uses Python's built-in network libraries to evaluate the target domain's encryption configuration.

Related Skills

Explore More Data & Analytics Skills→
Steffen025Steffen025
186

Recon

Automate passive and authorized active infrastructure reconnaissance across domains, IPs, netblocks, and ASNs.

Community
Advanced
briiirussellbriiirussell
345

osint-recon

Correlate public-source intelligence into structured OSINT reports with confidence scoring.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
JKhyroJKhyro

domain-intel

Map passive domain intelligence via subdomain, SSL, WHOIS, and DNS lookups.

Community
Intermediate