skills.rest
SethyPagna
SethyPagnaCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Perform passive domain reconnaissance via crt.sh, WHOIS, Google DoH, and TLS connections.

Updated May 14, 2026
Search Tags:#availability#dns#ssl#osint#whois#subdomains#domain intelligence
One-click install
npx skills add https://github.com/SethyPagna/Secretary-Jarvis --skill domain-intel-sethypagna
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/SethyPagna/Secretary-Jarvis/tree/main/src/capabilities/optional-skills/research/domain-intel
Command: npx skills add https://github.com/SethyPagna/Secretary-Jarvis --skill domain-intel-sethypagna

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

It removes the manual effort of gathering domain intelligence by collecting subdomains, certificate details, WHOIS data, DNS records, and availability signals in one place.

Core Features & Use Cases

  • Subdomain Discovery: Finds likely subdomains from certificate transparency logs for reconnaissance and asset inventory.
  • SSL and WHOIS Inspection: Checks certificate expiry, issuers, SANs, registration dates, and name servers for domain verification.
  • DNS and Availability Analysis: Retrieves A, AAAA, MX, NS, TXT, and CNAME records and combines passive signals to estimate whether a domain is registered.
  • Use Case: A researcher can quickly profile a target domain, compare multiple domains in bulk, and export structured JSON for follow-up analysis.

Quick Start

Ask the skill to analyze a domain such as example.com and return subdomains, SSL status, WHOIS details, DNS records, or bulk results as structured JSON.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without API keys?▼

Passive domain reconnaissance is performed using Python stdlib networking and JSON parsing to query crt.sh, WHOIS servers, and Google DoH. This approach requires no API keys or third-party packages to gather subdomains, SSL certificates, and DNS records.

Can I find subdomains using certificate transparency logs?▼

Subdomain discovery is achieved by querying certificate transparency logs via crt.sh. This passive method finds likely subdomains from issued certificates, functioning entirely without API keys or external dependencies.

How do I check SSL certificate expiry and WHOIS registration details?▼

SSL certificate inspection and WHOIS lookups are conducted via direct TLS connections and WHOIS servers. You can check certificate expiry, issuers, SANs, registration dates, and name servers for domain verification.

What is the best way to retrieve DNS records and check domain availability in bulk?▼

Bulk multi-domain analysis retrieves A, AAAA, MX, NS, TXT, and CNAME records using Google DoH. It combines passive DNS signals to estimate domain registration availability and exports structured JSON for follow-up analysis.

Do I need to install third-party packages to do OSINT domain intelligence gathering?▼

No third-party packages are needed for OSINT domain intelligence gathering. The process relies exclusively on Python standard library networking and JSON parsing, requiring zero dependencies and no API keys.

Can I export structured JSON from bulk domain intelligence analysis?▼

Structured JSON is exported from bulk multi-domain analysis. A researcher can quickly profile multiple target domains, compare subdomains, SSL status, WHOIS data, and DNS records, then export the structured JSON for follow-up analysis.

Related Skills

Explore More Education & Research Skills→
Steffen025Steffen025
186

Recon

Automate passive and authorized active infrastructure reconnaissance across domains, IPs, netblocks, and ASNs.

Community
Advanced
gqf2008gqf2008

domain-intel

Identify passive domain intelligence data using Python's standard library.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
GratefulJinx77GratefulJinx77

Recon

Perform passive and active network reconnaissance using WHOIS, DNS, and OSINT.

Community
Advanced