skills.rest
Yangel-hide
Yangel-hideCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Collect passive domain intelligence using Python's standard library and output structured JSON.

Updated May 3, 2026
Search Tags:#dns#osint#whois#subdomains#ssl-inspection#domain-intel#passive-analysis
One-click install
npx skills add https://github.com/Yangel-hide/video-production-planner-agent --skill domain-intel-yangel-hide
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/Yangel-hide/video-production-planner-agent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/Yangel-hide/video-production-planner-agent --skill domain-intel-yangel-hide

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Collects and consolidates passive domain intelligence using Python's standard library, enabling builds of OSINT workflows without API keys.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs (crt.sh) to identify related domains.
  • SSL certificate inspection and DNS record aggregation for quick domain profiling.
  • WHOIS lookups and bulk multi-domain analysis to monitor registration changes over time.
  • Output is structured JSON for easy ingestion into automation pipelines.

Quick Start

Run a single-domain passive reconnaissance pass against a target domain to gather subdomains, SSL, DNS, and WHOIS signals.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I gather passive domain intelligence without external API keys?▼

You can gather passive domain intelligence without API keys by using Python's standard library modules like socket, ssl, and urllib to enumerate subdomains, inspect SSL certificates, and query WHOIS data. This approach avoids external API dependencies entirely.

How do I enumerate subdomains using Certificate Transparency logs?▼

To enumerate subdomains using Certificate Transparency logs, query crt.sh via Python's built-in urllib module. This passive reconnaissance method identifies related domains without needing active scanning tools or third-party API authentication.

Can I perform bulk WHOIS lookups and DNS record aggregation across multiple domains?▼

Yes, you can perform bulk WHOIS lookups and DNS record aggregation across multiple domains. The Skill consolidates registration changes and DNS profiles into structured JSON, enabling quick multi-domain analysis to monitor assets over time.

Do I need to install external Python dependencies for OSINT subdomain discovery?▼

No, you do not need to install external Python dependencies for OSINT subdomain discovery. The Skill relies exclusively on built-in standard library modules, requiring zero external packages or API keys to execute passive domain reconnaissance.

What is the best way to output DNS and SSL details for automation pipelines?▼

The best way to output DNS and SSL details for automation pipelines is generating structured JSON. This format consolidates passive domain intelligence signals, ensuring easy ingestion and downstream processing for OSINT workflows.

Are there limitations to passive domain profiling using only Python standard libraries?▼

Limitations to passive domain profiling using only Python standard libraries include relying entirely on public sources like crt.sh for subdomain discovery. This avoids active scanning but may miss unindexed domains or fail silently if public endpoints are unreachable.

Related Skills

Explore More Data & Analytics Skills→
HarriesHarries

domain-intel

Gather subdomains, SSL data, WHOIS, DNS, and availability using Python standard library.

Community
Intermediate
madsstoumannmadsstoumann
13

is-website-safe

Analyze website safety via WHOIS, DNS, and Trustpilot reviews.

Community
Advanced
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
AeonDaveAeonDave
15

amass

Enumerate subdomains and map attack surfaces for a domain.

Community
Advanced