skills.rest
THTProtocol
THTProtocolCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Perform passive domain reconnaissance using Python stdlib without API keys.

Updated Aug 23, 2026
Search Tags:#domain reconnaissance#subdomain discovery#domain availability#WHOIS lookup#SSL certificate inspection#DNS analysis
One-click install
npx skills add https://github.com/THTProtocol/lastochka --skill domain-intel-thtprotocol
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/THTProtocol/lastochka/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/THTProtocol/lastochka --skill domain-intel-thtprotocol

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill provides passive domain reconnaissance capabilities, enabling users to discover subdomains, inspect SSL certificates, perform WHOIS lookups, analyze DNS records, and check domain availability without relying on API keys.

Core Features & Use Cases

  • Subdomain Discovery: Passive discovery of subdomains from certificate transparency logs.
  • SSL Certificate Inspection: Detailed examination of SSL certificate details, including expiry, cipher, and SANs.
  • WHOIS Lookup: Retrieval of domain registration information, including registrar, dates, and name servers.
  • DNS Records Analysis: Resolution of DNS records such as A, AAAA, MX, NS, TXT, and CNAME.
  • Domain Availability Check: Passive check for domain registration status using DNS, WHOIS, and SSL signals.
  • Use Case: Ideal for security audits, domain analysis, and competitive intelligence gathering.

Quick Start

Use the domain-intel skill to find subdomains for the domain 'example.com'.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without API keys?▼

Passive domain reconnaissance can be performed using Python stdlib to discover subdomains, inspect SSL certificates, execute WHOIS lookups, and analyze DNS records without requiring external API keys.

Can I discover subdomains from certificate transparency logs?▼

Yes, subdomain discovery is achieved passively by querying certificate transparency logs, allowing you to map subdomains without active scanning or authentication.

How do I check domain availability using DNS and WHOIS signals?▼

Domain availability checks passively aggregate DNS resolution, WHOIS registration data, and SSL certificate signals to determine if a domain is currently registered.

What DNS records can I resolve and analyze for a target domain?▼

You can resolve and analyze A, AAAA, MX, NS, TXT, and CNAME DNS records to map network infrastructure and mail routing configurations for target domains.

Does this approach retrieve SSL certificate details like expiry and SANs?▼

Yes, SSL certificate inspection extracts detailed information including certificate expiry dates, cipher suites, and Subject Alternative Names (SANs) for target domains.

What are the limitations of passive domain reconnaissance compared to active scanning?▼

Passive reconnaissance relies on existing signals like certificate transparency logs and DNS records, meaning it may miss subdomains or infrastructure changes not yet published in public records.

Related Skills

Explore More Data & Analytics Skills→
ragnarokhaaragnarokhaa
4

domain-intel

Identify subdomains, SSL details, WHOIS data, and DNS records using Python stdlib.

Community
Intermediate
ever-oliever-oli
3

domain-intel

Collect passive domain intelligence via subdomains, SSL, WHOIS, DNS, and availability.

Community
Intermediate
Ed1s0nZEd1s0nZ
5.6k

network-penetration-testing

Execute network penetration testing phases with Nmap, Nessus, and Metasploit.

Community
Advanced
AeonDaveAeonDave
15

amass

Enumerate subdomains and map attack surfaces for a domain.

Community
Advanced