skills.rest
Signmanal
SignmanalCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Collect subdomains, SSL certificates, WHOIS, and DNS records as JSON.

1|Updated Jun 25, 2026
Search Tags:#subdomain enumeration#domain availability#whois lookup#ssl inspection#dns resolution#domain osint#passive reconnaissance
One-click install
npx skills add https://github.com/Signmanal/VIGIL --skill domain-intel-signmanal
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/Signmanal/VIGIL/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/Signmanal/VIGIL --skill domain-intel-signmanal

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Security analysts and investigators often need to gather domain infrastructure intelligence including subdomains, SSL certificate details, WHOIS registration data, and DNS records, but typically require multiple paid tools or APIs to collect this passive reconnaissance data efficiently.

Core Features & Use Cases

  • Passive Subdomain Discovery: Enumerate subdomains from public Certificate Transparency logs via crt.sh with no active network scanning.
  • TLS & WHOIS Inspection: Retrieve SSL certificate expiry dates, issuers, and domain registration details (registrar, creation/expiry dates, name servers) for 100+ top-level domains.
  • DNS & Availability Checks: Resolve A, AAAA, MX, NS, TXT, and CNAME DNS records, plus heuristically determine if a domain is unregistered and available for purchase. Use Case: During a threat investigation, an analyst can quickly map all subdomains of a suspicious actor-controlled domain, check if its SSL certificate is nearing expiry to identify potentially abandoned infrastructure, and verify if related typosquatting domains are available for registration to preemptively block them.

Quick Start

Use the domain-intel skill to pull all active subdomains, check the SSL certificate expiry status, and retrieve WHOIS registration details for the domain suspicious-domain.com.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains using Certificate Transparency logs without active scanning?▼

Passive subdomain enumeration queries public Certificate Transparency logs via crt.sh to retrieve subdomains without active network scanning, requiring no external paid APIs. This method supports non-intrusive open-source intelligence workflows.

Can I retrieve WHOIS records and SSL certificate details using only the Python standard library?▼

Yes, you can retrieve WHOIS registration details and SSL certificate expiry dates using only the Python standard library. It requires zero external dependencies and zero API keys across Linux, macOS, and Windows.

How do I check if a domain is unregistered and available for purchase?▼

Domain availability checks use heuristics to determine if a domain is unregistered and available for purchase. This passive reconnaissance task resolves DNS entries and verifies registration status without active network interaction.

What is the best way to resolve DNS records for threat investigation workflows?▼

The best way to resolve DNS records for threat investigation is using a zero-dependency Python script that retrieves A, AAAA, MX, NS, TXT, and CNAME records, formatting all output as structured JSON for analyst workflows.

Does passive domain OSINT support cross-platform execution on Windows and macOS?▼

Passive domain OSINT supports cross-platform execution on Linux, macOS, and Windows. Using only the Python standard library ensures consistent subdomain enumeration, WHOIS lookup, and DNS resolution without platform-specific dependencies.

Related Skills

Explore More Data & Analytics Skills→
zangjeicyzangjeicy

domain-intel

Perform passive domain reconnaissance and DNS record resolution using Python standard libraries.

Community
Intermediate
luisgustavooliveiraluisgustavooliveira

Recon

Perform passive and active infrastructure reconnaissance using DNS, WHOIS, and IPInfo.

Community
Advanced
phatblatphatblat
12

Recon

Automate infrastructure and network reconnaissance for domains, IPs, and netblocks.

Community
Advanced
AeonDaveAeonDave
15

sublist3r

Enumerate subdomains passively via OSINT sources with optional brute-force wordlists.

Community
Intermediate