skills.rest
JamesFincher
JamesFincherCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Collect subdomain, TLS certificate, WHOIS, and DNS records for domains.

Updated May 4, 2026
Search Tags:#domain reconnaissance#osint#domain availability#whois#subdomains#dns records#tls certificate
One-click install
npx skills add https://github.com/JamesFincher/gengar --skill domain-intel-jamesfincher
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/JamesFincher/gengar/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/JamesFincher/gengar --skill domain-intel-jamesfincher

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps you quickly gather passive intelligence about a domain’s infrastructure and registration posture so you can make informed security, ops, or research decisions without manually stitching together DNS, TLS, and WHOIS lookups.

Core Features & Use Cases

  • Subdomain discovery (passive): Retrieves subdomains from Certificate Transparency logs (crt.sh).
  • TLS certificate inspection: Connects to the target on TCP 443 to extract certificate subject/issuer, SANs, cipher, and expiry status.
  • WHOIS and DNS intelligence: Queries WHOIS for registration metadata and resolves common DNS record types (A, AAAA, MX, NS, TXT, CNAME) using system DNS plus DNS-over-HTTPS.
  • Domain availability heuristic: Estimates whether a domain appears registered or available using DNS signals, WHOIS results, and basic TLS reachability.
  • Bulk analysis: Runs multiple checks across multiple domains and returns structured JSON output.

Use cases include investigating a suspected domain, validating what subdomains and TLS certificates are in circulation, collecting OSINT for onboarding vendor domains, or triaging domain takeover risk indicators.

Quick Start

Use domain-intel to run passive TLS and DNS intelligence for a target domain, for example: ask the agent to run the domain-intel skill command "ssl and dns for example.com" and return the structured JSON results.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains for a domain without using API keys?▼

Find subdomains without API keys by querying Certificate Transparency logs via crt.sh. This passive reconnaissance method collects issued TLS certificates and extracts their Subject Alternative Names to reveal active subdomains for the target domain.

What is passive domain reconnaissance and how does it work?▼

Passive domain reconnaissance gathers infrastructure intelligence without actively scanning the target. It queries third-party sources like Certificate Transparency logs, WHOIS databases, and DNS-over-HTTPS to collect subdomains, DNS records, and TLS certificate details.

Can I check domain availability using DNS and WHOIS signals?▼

Check domain availability using a heuristic that combines DNS resolution, WHOIS registration data, and TLS reachability. This approach estimates whether a domain is registered by correlating multiple passive signals rather than relying on a single lookup.

How do I retrieve TLS certificate details and DNS records for bulk domains?▼

Retrieve TLS certificate details and DNS records for bulk domains by running multi-domain queries that connect to TCP 443 and resolve A, AAAA, MX, NS, TXT, and CNAME records. Results are returned as structured JSON for downstream analysis.

Do I need to install external Python packages to query WHOIS and DNS records?▼

You do not need to install external Python packages to query WHOIS and DNS records. The Skill operates entirely on the Python standard library, using system DNS and Google DNS-over-HTTPS for lookups without requiring additional dependencies.

What are the limitations of using Certificate Transparency logs for subdomain discovery?▼

Certificate Transparency logs only reveal subdomains that have been issued TLS certificates. Subdomains operating without HTTPS or using wildcard certificates will not appear in crt.sh results, potentially missing valid infrastructure during reconnaissance.

Related Skills

Explore More Education & Research Skills→
ernijsansonsernijsansons

freight-intelligence-master

Coordinate freight intelligence gathering and campaign orchestration for RFP opportunities.

Community
Advanced
Quill-AgentQuill-Agent
3

domain-intel

Perform passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS, DNS records, and availability checks.

Community
Advanced
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
DaddyElonMusk69DaddyElonMusk69

domain-intel

Enumerate subdomains and inspect SSL certificates, WHOIS, and DNS records.

Community
Advanced