skills.rest
loteiron
loteironCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

domain-intel

Performs passive reconnaissance of subdomains, SSL certificates, WHOIS records, and DNS data.

Updated Sep 10, 2026
Search Tags:#reconnaissance#DNS#subdomain enumeration#OSINT#domain availability#whois#ssl certificate
One-click install
npx skills add https://github.com/loteiron/ZeusAgent --skill domain-intel-loteiron
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/loteiron/ZeusAgent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/loteiron/ZeusAgent --skill domain-intel-loteiron

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Gathering domain infrastructure intelligence normally requires multiple paid tools or API keys. This Skill answers questions about subdomains, TLS certificate expiry, domain registration, and DNS records using only Python's standard library and free passive data sources. ## Core Features & Use Cases - Subdomain Discovery: Enumerate subdomains from Certificate Transparency logs via crt.sh, with optional filtering of expired certificates. - SSL and WHOIS Inspection: Check TLS certificate expiry, cipher suites, and SANs, plus registrar, creation, and expiration dates across 100+ TLD WHOIS servers. - DNS and Availability Checks: Resolve A, AAAA, MX, NS, TXT, and CNAME records, and estimate domain availability from three passive signals. - Use Case: Before acquiring a domain for a new project, run a bulk check across candidate domains to see which are registered, when their certificates expire, and what DNS infrastructure already exists. ## Quick Start Ask the agent to find all subdomains of example.com and check when its SSL certificate expires using the domain-intel skill.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains of a domain without API keys?▼

Query Certificate Transparency logs through crt.sh, which publishes all issued TLS certificates. The subdomains command fetches these entries over HTTPS, deduplicates names, filters expired certificates, and returns up to 200 results as JSON.

How to check when an SSL certificate expires from the command line?▼

Connect to the host on TCP port 443 with Python's ssl module and parse the certificate's notAfter field. The ssl command reports days remaining, expiry status (OK, WARNING, CRITICAL, EXPIRED), cipher suite, TLS version, and subject alternative names.

Does this WHOIS lookup work on Windows and macOS?▼

Yes, the tool uses only Python standard library modules like socket, ssl, and urllib, so it runs identically on Linux, macOS, and Windows with no dependencies. Note that WHOIS queries use TCP port 43, which some restrictive networks block.

Why does WHOIS sometimes show no registrant information?▼

Many WHOIS servers redact registrant details due to GDPR privacy regulations, so owner fields may be missing even for registered domains. The tool still returns registrar, dates, name servers, and domain status when available.

Is the domain availability check authoritative?▼

No, it is a heuristic combining three passive signals: DNS resolution, WHOIS responses, and SSL reachability. It returns a verdict with a confidence level, but only a registrar API can authoritatively confirm availability for purchase.

When should I use web search instead of domain reconnaissance?▼

Use web search or content extraction for questions about what a company does or a page's content. Domain reconnaissance is for infrastructure data like subdomains, certificate expiry, registration dates, and DNS records that web search cannot provide.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

cert-transparency

Query crt.sh Certificate Transparency logs to extract deduplicated subdomains.

Community
Intermediate
GhostPWNGhostPWN
4

Reconnaissance & OSINT Automation

Map external attack surfaces by discovering subdomains, DNS records, and web technology fingerprints.

Official
Advanced
kortix-aikortix-ai
20.2k

account-research

Researches companies and people via web search, enrichment, and CRM data for outreach preparation.

Official
Intermediate
IceHeartGitHIceHeartGitH
1

domain-intel

Performs passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS, and DNS lookups.

Community
Intermediate