skills.rest
zerwiz
zerwizCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Your AI-powered command and data center for domain intelligence, delivering instant situational awareness and automated reporting to accelerate your next move.

1|Updated Apr 10, 2026
Search Tags:#dns#subdomain discovery#ssl#osint#whois#domain intelligence
One-click install
npx skills add https://github.com/zerwiz/wayofpi --skill domain-intel-zerwiz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/zerwiz/wayofpi/tree/main/.hermes/hermes-agent/optional-skills/research/domain-intel
Command: npx skills add https://github.com/zerwiz/wayofpi --skill domain-intel-zerwiz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill removes the manual overhead of gathering basic domain intelligence by collecting passive signals about a target domain in one place.

Core Features & Use Cases

  • Subdomain Discovery: Finds observed subdomains from certificate transparency data for reconnaissance and inventory work.
  • SSL and WHOIS Inspection: Checks certificate details, expiry, registrar data, name servers, and domain status for due diligence.
  • DNS and Availability Analysis: Resolves A, AAAA, MX, NS, TXT, and CNAME records and uses passive signals to estimate whether a domain is registered.
  • Bulk Research: Runs multiple checks across many domains in parallel for investigation, auditing, and triage workflows.

Quick Start

Ask the domain-intel skill to analyze example.com for subdomains, SSL details, WHOIS data, DNS records, or availability.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains using certificate transparency logs?▼

Subdomain discovery via certificate transparency logs involves querying public CT data sources to enumerate observed subdomains without touching the target infrastructure. This Skill automates that passive collection process alongside SSL inspection for reconnaissance.

How does passive DNS resolution work for domain intelligence?▼

Passive DNS resolution queries DNS-over-HTTPS endpoints to retrieve A, AAAA, MX, NS, TXT, and CNAME records without directly probing authoritative servers. This Skill uses that mechanism to gather domain intelligence while maintaining a non-intrusive footprint.

Can I perform bulk WHOIS lookups and SSL certificate checks across multiple domains?▼

Yes, bulk multi-domain analysis runs WHOIS TCP queries and TLS connectivity checks on port 443 in parallel across many targets. This Skill executes concurrent checks to triage registrar data, name servers, and certificate expiry for infrastructure auditing.

How do I check if a domain is registered without active scanning?▼

Domain availability checks use passive signals like WHOIS status codes and DNS resolution results to estimate registration state. This Skill aggregates those passive signals to determine if a domain is registered without sending active probes to the host.

What DNS record types are resolved during passive domain reconnaissance?▼

Passive domain reconnaissance resolves A, AAAA, MX, NS, TXT, and CNAME records using DNS-over-HTTPS protocols. This Skill collects these records alongside SSL certificate transparency data to provide a comprehensive infrastructure inventory.

What is the difference between active scanning and passive domain intelligence gathering?▼

Passive domain intelligence gathering collects signals from third-party sources like certificate transparency logs, WHOIS databases, and DNS-over-HTTPS without querying the target infrastructure directly. This Skill strictly performs passive collection to avoid triggering detection systems.

Related Skills

Explore More Education & Research Skills→
twjarviszyra-webtwjarviszyra-web
3

domain-intel

Extract subdomains, DNS records, WHOIS data, and SSL certificate details from domains.

Community
Intermediate
Quill-AgentQuill-Agent
3

domain-intel

Perform passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS, DNS records, and availability checks.

Community
Advanced
BishopCodesBishopCodes
1

Recon

Enumerate subdomains, DNS records, mail servers, and open ports.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

proto-dns

Enumerate DNS records and analyze security configurations for authorized domains.

Community
Advanced