skills.rest
Quill-Agent
Quill-AgentCOMMUNITY
Explore all skills by this author →
𝕏@QuillAgentGitHub

domain-intel

Perform passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS, DNS records, and availability checks.

3|1|Updated May 19, 2026
Search Tags:#OSINT#subdomain discovery#DNS records#domain availability#domain research#WHOIS lookup#SSL certificate inspection
One-click install
npx skills add https://github.com/Quill-Agent/Quill-Agent --skill domain-intel-quill-agent
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/Quill-Agent/Quill-Agent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/Quill-Agent/Quill-Agent --skill domain-intel-quill-agent

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill empowers users to gather comprehensive domain intelligence without the need for API keys or complex setup, making domain research efficient and accessible.

Core Features & Use Cases

  • Subdomain Discovery: Passive discovery of subdomains from certificate logs.
  • SSL Certificate Inspection: Detailed analysis of TLS certificate details.
  • WHOIS Lookup: Quick registration information and domain status.
  • DNS Records: Resolve DNS records including A, AAAA, MX, NS, TXT, CNAME.
  • Domain Availability Check: Passive availability check through DNS, WHOIS, and SSL signals.
  • Bulk Analysis: Perform multiple checks on multiple domains in parallel.
  • Use Case: If you need to analyze a range of domains for a research project, use the bulk analysis feature to save time and gather insights quickly.

Quick Start

Run the 'domain-intel' skill with the command: domain-intel.py bulk example.com github.com google.com --checks ssl,dns

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform subdomain discovery without external API dependencies?▼

Passive subdomain discovery extracts subdomains from certificate logs without requiring external API dependencies. It leverages built-in SSL certificate inspection to enumerate subdomains efficiently for infrastructure research.

Can I check domain availability through DNS and WHOIS signals?▼

Yes, domain availability checks analyze DNS records, WHOIS registration information, and SSL certificate signals passively. This multi-signal approach determines domain registration status without requiring external API keys.

What DNS records can I resolve during domain research?▼

Domain research DNS analysis resolves A, AAAA, MX, NS, TXT, and CNAME records. Analyzing these DNS records provides comprehensive insights into the target domain's infrastructure configuration and email routing setup.

How do I run bulk domain analysis on multiple domains in parallel?▼

Bulk domain analysis runs multiple infrastructure checks across multiple domains in parallel. Execute the script with a list of target domains and specify checks like SSL and DNS to gather comprehensive research insights quickly.

Do I need API keys for WHOIS lookup and SSL certificate inspection?▼

No, WHOIS lookups and SSL certificate inspection require no API keys. The domain intelligence gathering process operates entirely without external API dependencies, ensuring accessible and complex-free setup for infrastructure research.

What details does SSL certificate inspection reveal during domain reconnaissance?▼

SSL certificate inspection reveals detailed TLS certificate information during domain reconnaissance. It validates certificates and extracts subdomains from certificate transparency logs to support comprehensive infrastructure analysis.

Related Skills

Explore More Data & Analytics Skills→
zli5460zli5460
2

domain-intel

Perform passive OSINT domain analysis using DNS, WHOIS, SSL, and certificate transparency logs.

Community
Basic
eddieluengeddielueng
1

domain-intel

Collect subdomains, DNS records, TLS metadata, and WHOIS signals for a domain.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
Magnatrix-LabMagnatrix-Lab
1

offensive-osint

Enumerate domains and analyze external data for vulnerability discovery during red-team assessments.

Community
Advanced