skills.rest
GregsGreyCode
GregsGreyCodeCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Find subdomains, SSL certificates, WHOIS, and DNS records using Python's standard library.

6|2|Updated Mar 19, 2026
Search Tags:#dns#ssl#osint#whois#domain-intelligence#subdomains
One-click install
npx skills add https://github.com/GregsGreyCode/Logos --skill domain-intel-gregsgreycode
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/GregsGreyCode/Logos/tree/main/skills/research/domain-intel
Command: npx skills add https://github.com/GregsGreyCode/Logos --skill domain-intel-gregsgreycode

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance lets you discover subdomains, SSL details, WHOIS data, and DNS records using only Python's standard library, with no credentials or external APIs required.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs (crt.sh)
  • SSL certificate inspection, WHOIS lookups, DNS resolution, and bulk domain analysis
  • Use cases include security audits, infrastructure inventory, and brand or domain monitoring across single or multiple domains.

Quick Start

Run the domain_intel.py tool with a target domain to perform the desired check.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains and DNS records for a domain without using external APIs?▼

Passive domain reconnaissance extracts subdomains, SSL certificates, WHOIS data, and DNS records without querying the target directly. It uses public logs and standard libraries to gather infrastructure inventory for security assessments.

Can I perform bulk WHOIS lookups and SSL certificate checks across multiple domains?▼

Yes, you can perform bulk WHOIS lookups and SSL certificate checks across multiple domains. The tool provides a bulk command that outputs structured JSON suitable for automated domain monitoring and infrastructure analysis.

Do I need to install external Python libraries to retrieve SSL certificate details and WHOIS information?▼

Subdomain discovery via Certificate Transparency logs relies on querying public crt.sh logs. It passively collects issued SSL certificates to map subdomains without actively scanning the target domain's network.

What is the best way to monitor domain infrastructure changes using Python?▼

Limitations of passive OSINT include relying solely on public Certificate Transparency logs and standard library queries. It does not perform active network scanning, meaning unlogged or non-public subdomains will remain undiscovered.

Related Skills

Explore More Education & Research Skills→
Steffen025Steffen025
186

Recon

Automate passive and authorized active infrastructure reconnaissance across domains, IPs, netblocks, and ASNs.

Community
Advanced
metric-space-aimetric-space-ai
2

ticket-monitoring-ingest

Ingests monitoring snapshots from systems like Prometheus and Grafana into ticket context via CLI.

Official
Intermediate
enderphan94enderphan94
1

stress-recon

Enumerate subdomains, URLs, and endpoints for security assessments.

Community
Intermediate
GratefulJinx77GratefulJinx77

Recon

Perform passive and active network reconnaissance using WHOIS, DNS, and OSINT.

Community
Advanced