domain-intel

Generate passive domain reconnaissance with subdomain, DNS, TLS, and WHOIS checks.

Updated May 5, 2026
One-click install
npx skills add https://github.com/Z43L/zeus-agent --skill domain-intel-z43l
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/Z43L/zeus-agent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/Z43L/zeus-agent --skill domain-intel-z43l

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

You need fast, practical intelligence about a domain’s external footprint (subdomains, TLS/SSL details, DNS records, WHOIS registration signals, and availability) without setting up heavy tooling or requiring API keys.

Core Features & Use Cases

  • Subdomain discovery from Certificate Transparency logs to enumerate likely subdomains for a target.
  • TLS/SSL inspection to retrieve certificate issuer, subject, SANs, and expiry risk signals via a direct port 443 connection.
  • WHOIS + DNS intelligence to gather registration hints (where available) and resolve A/AAAA/MX/NS/TXT/CNAME data.
  • Availability heuristic combining DNS, WHOIS, and SSL reachability to estimate whether a domain is likely registered or available.

Quick Start

Ask your agent to run the domain-intel skill to check multiple domains and return JSON output for ssl,dns,whois in bulk.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I gather subdomains and DNS records for a domain without using CLI tools?

Passive domain reconnaissance uses Certificate Transparency logs and direct HTTPS queries to enumerate subdomains and resolve DNS records without manual CLI work. The Skill returns structured JSON output for security due diligence.

Can I check TLS certificate details and expiry risk for multiple domains in bulk?

Yes, TLS inspection retrieves issuer, subject, SANs, and expiry risk signals via port 443 connections. The Skill supports bulk parallel checks across multiple domains to return structured JSON output.

What is passive OSINT for domain reconnaissance and when do I need it?

Passive OSINT identifies a domain's publicly observable footprint including WHOIS registration signals and DNS records. You need it for pre-engagement due diligence and security-minded infrastructure discovery without requiring API keys.

Does domain reconnaissance work without external API keys or heavy tooling?

Yes, passive reconnaissance uses a Python-stdlib toolchain with passive HTTPS and TCP queries to gather WHOIS and DNS intelligence. It requires no external API keys or heavy tooling setup to produce structured JSON results.

How do I check if a domain is likely available or already registered?

An availability heuristic combines DNS, WHOIS, and SSL reachability to estimate whether a domain is likely registered or available. The Skill applies this heuristic across bulk parallel checks to return structured JSON output.

What are the limitations of passive OSINT for subdomain enumeration?

Passive OSINT relies on Certificate Transparency logs and does not perform active scanning or brute-forcing. It gathers publicly observable footprint data only, meaning unlisted or non-certified subdomains will not appear in the structured JSON output.