skills.rest
ZardLi1115
ZardLi1115COMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Generate passive domain reconnaissance with subdomains, TLS, DNS, WHOIS, and availability signals.

4|Updated May 18, 2026
Search Tags:#osint#whois#subdomains#dns records#tls certificates#domain intelligence#bulk analysis
One-click install
npx skills add https://github.com/ZardLi1115/zedclaw --skill domain-intel-zardli1115
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/ZardLi1115/zedclaw/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/ZardLi1115/zedclaw --skill domain-intel-zardli1115

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Domain Intelligence removes the guesswork of gathering security- and infrastructure-relevant facts about a domain by producing subdomain, TLS, DNS, WHOIS, and availability signals without needing paid APIs or credentials.

Core Features & Use Cases

  • Passive subdomain discovery from Certificate Transparency logs to expand an attack/ownership surface for auditing and research.
  • TLS certificate inspection (expiry, SANs, issuer, cipher, protocol) to support security reviews, migration planning, and operational health checks.
  • DNS + WHOIS reconnaissance to collect record types, registration metadata, and practical availability heuristics for domain due diligence.
  • Bulk multi-domain analysis to run the same checks across multiple domains in parallel and return structured JSON output for downstream automation.

Quick Start

Ask the agent to run the domain-intel skill for bulk analysis of example.com, github.com, and google.com with SSL and DNS checks, returning JSON for each domain.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains and DNS records without using paid APIs?▼

Passive domain reconnaissance finds subdomains and DNS records without paid APIs by querying Certificate Transparency logs via crt.sh and resolving records using DNS-over-HTTPS, returning structured JSON output for infrastructure auditing.

Can I check TLS certificate health and expiry dates in bulk across multiple domains?▼

Bulk multi-domain analysis checks TLS certificate health and expiry dates in parallel across multiple domains using TCP/TLS queries, producing structured JSON output with certificate issuer, SANs, cipher, and protocol details for operational reviews.

What is passive domain reconnaissance and when do I need it for OSINT workflows?▼

Passive domain reconnaissance collects subdomains, TLS details, DNS records, and WHOIS signals without active scanning, supporting OSINT workflows, operational due diligence, and infrastructure research when you need certificate health checks or domain ownership discovery.

How do I gather WHOIS registration signals and domain availability heuristics?▼

WHOIS registration signals and domain availability heuristics are gathered through TCP/TLS queries for WHOIS inspection, extracting registration metadata and practical availability data to support domain due diligence without requiring API credentials.

Does domain intelligence reconnaissance require API keys or external credentials?▼

Domain intelligence reconnaissance minimizes or avoids API keys entirely by using Python standard library tools, crt.sh for CT data, DNS-over-Https for resolution, and direct TCP/TLS queries for SSL and WHOIS inspection.

What are the limitations of using Certificate Transparency logs for subdomain discovery?▼

Subdomain discovery using Certificate Transparency logs via crt.sh is limited to domains with issued TLS certificates, meaning non-SSL subdomains or internal hosts without public certificates will not appear in the passive reconnaissance results.

Related Skills

Explore More Education & Research Skills→
HarriesHarries

domain-intel

Gather subdomains, SSL data, WHOIS, DNS, and availability using Python standard library.

Community
Intermediate
wgpsecwgpsec
1.6k

httpx-probe

Probe URL lists for live HTTP/HTTPS services and collect fingerprints, titles, headers, and TLS metadata.

Official
Intermediate
RooseveltAdvisorsRooseveltAdvisors
1

Recon

Automate network reconnaissance for domains, IPs, and netblocks.

Community
Advanced
BishopCodesBishopCodes
1

Investigation

Conduct structured OSINT investigations on individuals and companies using public data sources.

Community
Advanced