domain-intel

Collect passive domain intelligence using Python's standard library and output structured JSON.

Updated May 3, 2026

Search Tags:#dns #osint #whois #subdomains #ssl-inspection #domain-intel #passive-analysis

Ready to run

npx skills add https://github.com/Yangel-hide/video-production-planner-agent --skill domain-intel-yangel-hide

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/Yangel-hide/video-production-planner-agent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/Yangel-hide/video-production-planner-agent --skill domain-intel-yangel-hide

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Collects and consolidates passive domain intelligence using Python's standard library, enabling builds of OSINT workflows without API keys.

Core Features & Use Cases

Subdomain discovery via Certificate Transparency logs (crt.sh) to identify related domains.
SSL certificate inspection and DNS record aggregation for quick domain profiling.
WHOIS lookups and bulk multi-domain analysis to monitor registration changes over time.
Output is structured JSON for easy ingestion into automation pipelines.

Quick Start

Run a single-domain passive reconnaissance pass against a target domain to gather subdomains, SSL, DNS, and WHOIS signals.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I gather passive domain intelligence without external API keys?▼

You can gather passive domain intelligence without API keys by using Python's standard library modules like socket, ssl, and urllib to enumerate subdomains, inspect SSL certificates, and query WHOIS data. This approach avoids external API dependencies entirely.

How do I enumerate subdomains using Certificate Transparency logs?▼

To enumerate subdomains using Certificate Transparency logs, query crt.sh via Python's built-in urllib module. This passive reconnaissance method identifies related domains without needing active scanning tools or third-party API authentication.

Can I perform bulk WHOIS lookups and DNS record aggregation across multiple domains?▼

Yes, you can perform bulk WHOIS lookups and DNS record aggregation across multiple domains. The Skill consolidates registration changes and DNS profiles into structured JSON, enabling quick multi-domain analysis to monitor assets over time.

Do I need to install external Python dependencies for OSINT subdomain discovery?▼

No, you do not need to install external Python dependencies for OSINT subdomain discovery. The Skill relies exclusively on built-in standard library modules, requiring zero external packages or API keys to execute passive domain reconnaissance.

What is the best way to output DNS and SSL details for automation pipelines?▼

The best way to output DNS and SSL details for automation pipelines is generating structured JSON. This format consolidates passive domain intelligence signals, ensuring easy ingestion and downstream processing for OSINT workflows.

Are there limitations to passive domain profiling using only Python standard libraries?▼

Limitations to passive domain profiling using only Python standard libraries include relying entirely on public sources like crt.sh for subdomain discovery. This avoids active scanning but may miss unindexed domains or fail silently if public endpoints are unreachable.