domain-intel

Generate a structured Markdown domain intelligence report from passive public sources.

Updated Apr 1, 2026

Search Tags:#hosting #dns #whois #public-sources #domain-intelligence #certificate-transparency

Ready to run

npx skills add https://github.com/hpsgd/turtlestack --skill domain-intel-hpsgd

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/hpsgd/turtlestack/tree/main/plugins/research/investigator/skills/domain-intel
Command: npx skills add https://github.com/hpsgd/turtlestack --skill domain-intel-hpsgd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Gather domain-level intelligence by leveraging passive public sources to map ownership, registration details, DNS infrastructure, certificates, hosting, and history for a given domain.

Core Features & Use Cases

Registration & ownership: Retrieve registrant, registrar, creation/expiry dates, and name servers via WHOIS.
DNS & infrastructure: Compile A, AAAA, MX, TXT, NS, and CNAME records to reveal hosting providers and email arrangements.
Certificate transparency & environment discovery: Identify observed subdomains, issuer types, and HTTPS adoption to infer environments and service boundaries.
Historical context & related domains: Track site history via Wayback, DNS history, and identify related domains by registrant or organization.

Quick Start

Provide a domain name to generate a passive-domain intelligence report.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I map a domain's infrastructure using passive public sources?▼

To map domain infrastructure using passive public sources, generate a domain intelligence report that compiles WHOIS registration data, DNS records, certificate transparency logs, and IP geolocation into a structured Markdown format.

What is the best way to discover subdomains and hosting providers from DNS records?▼

Discovering subdomains and hosting providers involves querying certificate transparency logs via crt.sh and compiling A, AAAA, MX, TXT, NS, and CNAME DNS records to reveal underlying infrastructure and service boundaries.

Can I track a domain's historical WHOIS and DNS changes without active scanning?▼

Yes, you can track historical WHOIS and DNS changes passively by leveraging historical data sources like the Wayback Machine and DNS history databases to observe past site configurations and ownership.

Does domain intelligence gathering work for finding related domains owned by the same organization?▼

Domain intelligence gathering identifies related domains by querying WHOIS data and matching registrant or organization fields, allowing you to map ownership across multiple registered properties.

What public data sources are needed to compile a comprehensive domain ownership report?▼

Compiling a comprehensive domain ownership report requires accessing WHOIS, MXToolbox or dnsdumpster for DNS lookups, crt.sh for certificates, ipinfo or BGP for geolocation, ViewDNS, Wayback Machine, and SecurityTrails.

How do I infer a domain's environment boundaries using certificate transparency logs?▼

Inferring environment boundaries using certificate transparency logs involves analyzing observed subdomains, issuer types, and HTTPS adoption from crt.sh data to identify distinct service environments.