skills.rest
math-inc
math-incOFFICIAL
Explore all skills by this author →
Website𝕏@mathematics_incGitHub

domain-intel

Identify subdomains, certificates, and ownership signals from DNS, SSL, and WHOIS records.

1.2k|116|Updated Mar 19, 2026
Search Tags:#dns#ssl#osint#whois#subdomains#bulk-analysis#domain-intel
One-click install
npx skills add https://github.com/math-inc/OpenGauss --skill domain-intel-math-inc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/math-inc/OpenGauss/tree/main/skills/research/domain-intel
Command: npx skills add https://github.com/math-inc/OpenGauss --skill domain-intel-math-inc

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance using only Python stdlib. Zero dependencies. Works on Linux, macOS, and Windows.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs (crt.sh)
  • SSL certificate inspection (expiry, issuer, SANs)
  • WHOIS lookup, DNS records, bulk multi-domain analysis
  • Output is structured JSON for automation and reporting

Quick Start

Run the script SKILL_DIR/scripts/domain_intel.py subdomains example.com to begin subdomain discovery.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains using Certificate Transparency logs without API keys?▼

Subdomain discovery via Certificate Transparency logs queries crt.sh to surface subdomains passively. The script returns structured JSON, requiring zero API keys or external dependencies to identify domain infrastructure.

What passive OSINT data can I gather from DNS and WHOIS records?▼

Passive OSINT data gathered from DNS and WHOIS records includes subdomains, SSL certificates, expiry dates, issuers, SANs, and ownership signals. It leverages Python stdlib to query these records without active scanning.

Can I perform bulk domain analysis across multiple domains simultaneously?▼

Bulk multi-domain analysis processes multiple domains simultaneously to surface certificates and ownership signals across infrastructure portfolios. It outputs JSON-formatted results suitable for automation and reporting.

Does passive domain intelligence work on Windows without installing external dependencies?▼

Passive domain intelligence works on Linux, macOS, and Windows without installing external dependencies. It relies entirely on the Python standard library to perform DNS, SSL, and WHOIS lookups.

How do I inspect SSL certificate expiry and issuer details for a domain?▼

Inspecting SSL certificates extracts expiry dates, issuer information, and Subject Alternative Names (SANs) directly from the target domain. This data is output as structured JSON for security investigations and reporting.

Related Skills

Explore More Data & Analytics Skills→
jason660519jason660519

domain-intel

Perform passive OSINT on domains using only Python stdlib.

Community
Intermediate
anysiteioanysiteio
19

anysite-competitor-analyzer

Aggregate competitor intelligence from LinkedIn, GitHub, and community sources.

Official
Advanced
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
BishopCodesBishopCodes
1

Recon

Enumerate subdomains, DNS records, mail servers, and open ports.

Community
Advanced