skills.rest
nadicodeai
nadicodeaiOFFICIAL
Explore all skills by this author →
WebsiteGitHub

domain-intel

Collect subdomains, SSL certificates, WHOIS, and DNS records via passive OSINT.

Updated Apr 9, 2026
Search Tags:#dns#ssl#osint#whois#domain-intelligence#subdomains#passive
One-click install
npx skills add https://github.com/nadicodeai/argo-agent --skill domain-intel-nadicodeai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/nadicodeai/argo-agent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/nadicodeai/argo-agent --skill domain-intel-nadicodeai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance without API keys helps teams rapidly gather domain-related data such as subdomains, certificate details, ownership information, DNS records, and domain availability signals in a privacy-preserving manner.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs
  • SSL certificate inspection (expiry, issuer, SANs)
  • WHOIS lookups and domain registration data
  • DNS record aggregation (A/AAAA/MX/NS/TXT/CNAME)
  • Bulk analysis across multiple domains
  • Use cases include security investigations, brand monitoring, and infrastructure inventory.

Quick Start

Run python3 SKILL_DIR/scripts/domain_intel.py subdomains example.com to start discovering subdomains.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without using external APIs?▼

Passive OSINT gathers domain intelligence like subdomains, SSL certificates, and DNS records without active scanning. It queries Certificate Transparency logs and public records to provide privacy-preserving data for security investigations and brand monitoring.

Can I discover subdomains using Certificate Transparency logs with Python?▼

You can discover subdomains via Certificate Transparency logs using a Python stdlib script. This method queries public CT data to enumerate subdomains passively without requiring external API keys or active network scanning.

What is the best way to aggregate DNS records like A, MX, and TXT in bulk?▼

The best way to aggregate DNS records across multiple domains is using a deterministic CLI command. It queries A, AAAA, MX, NS, TXT, and CNAME records, outputting structured JSON for infrastructure inventory and security analysis.

Do I need API keys to check SSL certificate expiry and issuer details?▼

No, you do not need API keys to check SSL certificate expiry and issuer details. Passive domain intelligence scripts inspect SSL certificates directly, extracting expiry dates, issuer information, and Subject Alternative Names offline.

How do I get structured JSON outputs for WHOIS lookups and domain registration data?▼

You can get structured JSON outputs for WHOIS lookups by running a deterministic CLI command that parses domain registration data. This Python stdlib approach formats ownership information into JSON for security investigations and brand monitoring.

Are there limitations to offline-friendly subdomain discovery without external APIs?▼

Limitations of offline-friendly subdomain discovery include relying entirely on cached Certificate Transparency logs and passive DNS records. Without external APIs, newly created subdomains might be missed during security investigations.

Related Skills

Explore More Data & Analytics Skills→
brucesongsbrucesongs
60

recon-osint

Perform OSINT reconnaissance to build target profiles from public sources.

Community
Advanced
anysiteioanysiteio
19

anysite-competitor-analyzer

Aggregate competitor intelligence from LinkedIn, GitHub, and community sources.

Official
Advanced
heysuhasheysuhas
2

domain-intel

Perform passive domain reconnaissance using standard Python libraries.

Community
Intermediate
Steffen025Steffen025
186

Recon

Automate passive and authorized active infrastructure reconnaissance across domains, IPs, netblocks, and ASNs.

Community
Advanced