skills.rest
superfhp
superfhpCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Perform passive domain reconnaissance using Python stdlib for subdomains, SSL, WHOIS, and DNS.

Updated May 8, 2026
Search Tags:#OSINT#domain reconnaissance#subdomain discovery#WHOIS lookup#SSL certificate
One-click install
npx skills add https://github.com/superfhp/lumi-agent --skill domain-intel-superfhp
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/superfhp/lumi-agent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/superfhp/lumi-agent --skill domain-intel-superfhp

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill solves the problem of manual and time-consuming domain reconnaissance by automating tasks such as subdomain discovery, SSL certificate inspection, WHOIS lookups, DNS records checking, and domain availability checks.

Core Features & Use Cases

  • Subdomain Discovery: Finds subdomains using Certificate Transparency logs.
  • SSL Certificate Inspection: Inspects TLS certificate details, expiry, and cipher suite.
  • WHOIS Lookup: Provides registration info, registrar, dates, name servers for 100+ TLDs.
  • DNS Records: Fetches A, AAAA, MX, NS, TXT, CNAME records.
  • Domain Availability Check: Determines if a domain is registered based on DNS, WHOIS, and SSL signals.
  • Use Case: When auditing the infrastructure of a potential target, use this Skill to quickly gather intelligence without manual searches.

Quick Start

Run the 'domain-intel' skill with the 'subdomains' command to find all subdomains of a target domain.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance to find subdomains without extra dependencies?▼

Passive domain reconnaissance finds subdomains by querying Certificate Transparency logs. This method uses Python stdlib for networking and cryptography to enumerate subdomains without sending direct probe requests to the target infrastructure.

How do I check SSL certificate details and expiry for a target domain?▼

Checking SSL certificate details involves inspecting TLS certificates to retrieve expiry dates and cipher suite information. This Skill uses Python stdlib cryptography modules to parse certificate data during the connection handshake.

Can I fetch DNS records like A, MX, and TXT using only Python stdlib?▼

Yes, fetching DNS records like A, AAAA, MX, NS, TXT, and CNAME is possible using Python stdlib. The Skill resolves domain records natively without requiring external DNS resolution libraries or third-party dependencies.

Does domain reconnaissance work on Windows, macOS, and Linux without installing dependencies?▼

Domain reconnaissance works on Linux, macOS, and Windows without additional dependencies. It utilizes Python standard library modules exclusively, ensuring cross-platform compatibility for infrastructure analysis and cybersecurity audits.

What is the best way to check domain availability using DNS and WHOIS signals?▼

Checking domain availability is best done by cross-referencing DNS, WHOIS, and SSL signals. The Skill analyzes these three data sources to determine if a domain is registered, providing a comprehensive availability check.

How do I get WHOIS registration info and name servers for various TLDs?▼

Getting WHOIS registration info involves querying WHOIS databases to extract registrar details, registration dates, and name servers. This Skill supports lookups for over 100 different TLDs using Python stdlib networking.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
5

subdomain-enum

Enumerate subdomains with Subfinder, Amass, and Httpx pipelines.

Community
Advanced
ever-oliever-oli
3

domain-intel

Collect passive domain intelligence via subdomains, SSL, WHOIS, DNS, and availability.

Community
Intermediate
protoLabsAIprotoLabsAI
2

recon-sweep

Perform passive and scoped active reconnaissance on network targets and domains.

Official
Advanced
Quill-AgentQuill-Agent
3

domain-intel

Perform passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS, DNS records, and availability checks.

Community
Advanced