skills.rest
hpsgd
hpsgdOFFICIAL
Explore all skills by this author →
WebsiteGitHub

domain-intel

Generate a structured Markdown domain intelligence report from passive public sources.

Updated Apr 1, 2026
Search Tags:#hosting#dns#whois#public-sources#domain-intelligence#certificate-transparency
One-click install
npx skills add https://github.com/hpsgd/turtlestack --skill domain-intel-hpsgd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/hpsgd/turtlestack/tree/main/plugins/research/investigator/skills/domain-intel
Command: npx skills add https://github.com/hpsgd/turtlestack --skill domain-intel-hpsgd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Gather domain-level intelligence by leveraging passive public sources to map ownership, registration details, DNS infrastructure, certificates, hosting, and history for a given domain.

Core Features & Use Cases

  • Registration & ownership: Retrieve registrant, registrar, creation/expiry dates, and name servers via WHOIS.
  • DNS & infrastructure: Compile A, AAAA, MX, TXT, NS, and CNAME records to reveal hosting providers and email arrangements.
  • Certificate transparency & environment discovery: Identify observed subdomains, issuer types, and HTTPS adoption to infer environments and service boundaries.
  • Historical context & related domains: Track site history via Wayback, DNS history, and identify related domains by registrant or organization.

Quick Start

Provide a domain name to generate a passive-domain intelligence report.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map a domain's infrastructure using passive public sources?▼

To map domain infrastructure using passive public sources, generate a domain intelligence report that compiles WHOIS registration data, DNS records, certificate transparency logs, and IP geolocation into a structured Markdown format.

What is the best way to discover subdomains and hosting providers from DNS records?▼

Discovering subdomains and hosting providers involves querying certificate transparency logs via crt.sh and compiling A, AAAA, MX, TXT, NS, and CNAME DNS records to reveal underlying infrastructure and service boundaries.

Can I track a domain's historical WHOIS and DNS changes without active scanning?▼

Yes, you can track historical WHOIS and DNS changes passively by leveraging historical data sources like the Wayback Machine and DNS history databases to observe past site configurations and ownership.

Does domain intelligence gathering work for finding related domains owned by the same organization?▼

Domain intelligence gathering identifies related domains by querying WHOIS data and matching registrant or organization fields, allowing you to map ownership across multiple registered properties.

What public data sources are needed to compile a comprehensive domain ownership report?▼

Compiling a comprehensive domain ownership report requires accessing WHOIS, MXToolbox or dnsdumpster for DNS lookups, crt.sh for certificates, ipinfo or BGP for geolocation, ViewDNS, Wayback Machine, and SecurityTrails.

How do I infer a domain's environment boundaries using certificate transparency logs?▼

Inferring environment boundaries using certificate transparency logs involves analyzing observed subdomains, issuer types, and HTTPS adoption from crt.sh data to identify distinct service environments.

Related Skills

Explore More Data & Analytics Skills→
KarlinskySKarlinskyS

domain-intel

Perform passive domain intelligence using only Python stdlib.

Community
Intermediate
EojEdredEojEdred

security-dev01

Monitor validators and analyze SSH logs for security threats.

Community
Intermediate
BishopCodesBishopCodes
1

Recon

Enumerate subdomains, DNS records, mail servers, and open ports.

Community
Advanced
RooseveltAdvisorsRooseveltAdvisors
1

Investigation

Conduct structured OSINT investigations across individuals, companies, domains, and threats.

Community
Advanced