skills.rest
LynxLabVN
LynxLabVNOFFICIAL
Explore all skills by this author →
GitHub

domain-intel

Automate passive domain reconnaissance using Python's standard library.

Updated Jul 3, 2026
Search Tags:#domain reconnaissance#subdomain discovery#DNS records#WHOIS lookup#SSL certificate inspection
One-click install
npx skills add https://github.com/LynxLabVN/office-agent --skill domain-intel-lynxlabvn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/LynxLabVN/office-agent/tree/main/agent-core/optional-skills/research/domain-intel
Command: npx skills add https://github.com/LynxLabVN/office-agent --skill domain-intel-lynxlabvn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill automates the process of domain reconnaissance, providing a range of passive OSINT capabilities including subdomain discovery, SSL certificate inspection, WHOIS lookups, DNS records, domain availability checks, and bulk multi-domain analysis, without the need for API keys.

Core Features & Use Cases

  • Subdomain Discovery: Find subdomains using certificate transparency logs.
  • SSL Certificate Inspection: Examine TLS certificate details including expiry, cipher, SANs, and issuer.
  • WHOIS Lookup: Retrieve registration information, registrar, dates, name servers, and status across 100+ TLDs.
  • DNS Records: Resolve A, AAAA, MX, NS, TXT, CNAME records.
  • Domain Availability Check: Passive availability checks using DNS, WHOIS, and SSL signals.
  • Bulk Analysis: Run multiple checks on multiple domains in parallel.
  • Use Case: Use this Skill to quickly gather domain-related information for cybersecurity and digital forensics tasks.

Quick Start

Use the domain-intel skill to list subdomains for 'example.com'.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains using certificate transparency logs without API keys?▼

Subdomain discovery works by querying certificate transparency logs to find associated subdomains. This passive reconnaissance approach requires no API keys and operates using only Python's standard library across Linux, macOS, and Windows.

Can I perform WHOIS lookups and DNS resolution across different operating systems without installing dependencies?▼

WHOIS lookups and DNS resolution run seamlessly on Linux, macOS, and Windows without external dependencies. The tool uses Python's standard library to retrieve registration information across 100+ TLDs and resolve A, AAAA, MX, NS, TXT, and CNAME records.

What is passive domain reconnaissance and how does it differ from active scanning?▼

Passive domain reconnaissance gathers OSINT data without directly interacting with or probing the target's live servers. It relies on third-party sources like certificate transparency logs and DNS records to collect subdomains, SSL certificates, and WHOIS data securely.

How do I check domain availability using DNS, WHOIS, and SSL signals?▼

Domain availability is checked passively by cross-referencing DNS resolution, WHOIS registration data, and SSL certificate presence. This method quickly determines if a domain is registered and active without sending direct probe requests to the target host.

What is the best way to run bulk multi-domain analysis for cybersecurity tasks?▼

Bulk multi-domain analysis runs multiple passive reconnaissance checks on several domains in parallel. You can gather subdomains, SSL details, WHOIS data, and DNS records simultaneously to accelerate digital forensics and cybersecurity investigations.

Are there limitations to passive OSINT techniques for SSL certificate inspection?▼

SSL certificate inspection is limited to examining publicly available TLS details like expiry dates, ciphers, SANs, and issuers. It does not perform active vulnerability scanning or probe for misconfigurations beyond what the presented certificate metadata shows.

Related Skills

Explore More Software Engineering Skills→
zeronx798zeronx798

domain-intel

Perform passive domain reconnaissance using Python standard library modules.

Community
Intermediate
Quill-AgentQuill-Agent
3

domain-intel

Perform passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS, DNS records, and availability checks.

Community
Advanced
phatblatphatblat
12

Recon

Automate infrastructure and network reconnaissance for domains, IPs, and netblocks.

Community
Advanced
mishahaninmishahanin
10

osint-advanced

Query sanctions lists, corporate registries, and breach databases to generate structured intelligence briefs.

Community
Advanced