domain-intel

Performs passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS, and DNS lookups.

Updated Jun 5, 2026
One-click install
npx skills add https://github.com/xu1713/openhorse --skill domain-intel-xu1713
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/xu1713/openhorse/tree/main/openhorse/openhorse/optional-skills/research/domain-intel
Command: npx skills add https://github.com/xu1713/openhorse --skill domain-intel-xu1713

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Gathering infrastructure intelligence about a domain—its subdomains, SSL certificate status, registration details, and DNS records—normally requires multiple separate tools or paid APIs. This Skill consolidates all passive domain reconnaissance into a single CLI that runs with only the Python standard library and no API keys. ## Core Features & Use Cases - Subdomain Discovery: Enumerate subdomains from Certificate Transparency logs via crt.sh, with expired-certificate filtering. - SSL & WHOIS Inspection: Check TLS certificate expiry, cipher suites, and SANs, plus registrar, creation, and expiration dates across 100+ TLD WHOIS servers. - DNS & Availability Checks: Resolve A, AAAA, MX, NS, TXT, and CNAME records, and estimate domain availability from passive DNS, WHOIS, and SSL signals. - Bulk Analysis: Run multiple checks across up to 20 domains in parallel with structured JSON output. - Use Case: Before acquiring a domain for a new project, run the availability check on several candidates, then inspect SSL expiry and WHOIS history of a competitor's domain for research. ## Quick Start Ask the AI to find all subdomains of example.com and check when its SSL certificate expires using the domain intelligence script.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains of a domain without an API key?

Query Certificate Transparency logs through crt.sh, which publishes all issued TLS certificates. Run the subdomains command with the target domain to get a deduplicated list of subdomains, optionally filtering out expired certificates.

How to check when an SSL certificate expires from the command line?

Connect to the host on port 443 with a TLS handshake and parse the certificate's notAfter field. The ssl command returns days remaining, expiry status, cipher suite, TLS version, and subject alternative names as JSON.

Does this domain reconnaissance tool work on Windows?

Yes, it runs identically on Linux, macOS, and Windows because it uses only Python standard library modules like socket, ssl, and urllib. No third-party packages or platform-specific tools are required.

Why does the WHOIS lookup fail on some networks?

WHOIS queries use TCP port 43, which is blocked on many restrictive corporate or cloud networks. DNS lookups via Google DNS-over-HTTPS and crt.sh queries use HTTPS port 443, so they typically still work behind firewalls.

How accurate is the domain availability check?

The availability check is heuristic, combining three passive signals: DNS resolution, WHOIS responses, and SSL reachability. It returns a verdict with a confidence level, but it is not authoritative like a registrar API, so confirm with a registrar before purchasing.