skills.rest
zulumonkeymetallic
zulumonkeymetallicCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Discover subdomains, inspect TLS certificates, perform WHOIS lookups, and collect DNS records.

Updated Aug 23, 2026
Search Tags:#dns#ssl#osint#whois#subdomains#domain-intel#passive
One-click install
npx skills add https://github.com/zulumonkeymetallic/bob --skill domain-intel-zulumonkeymetallic
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/zulumonkeymetallic/bob/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/zulumonkeymetallic/bob --skill domain-intel-zulumonkeymetallic

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance and intelligence gathering for security and infrastructure teams, without relying on external APIs.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs (crt.sh)
  • SSL certificate inspection (expiry, issuer, SANs)
  • WHOIS lookups across 100+ registrars
  • DNS records: A/AAAA/MX/NS/TXT/CNAME via Google DoH and system DNS
  • Bulk analysis across multiple domains with parallel processing

Quick Start

Run the domain_intel.py script with the subdomains example.com command to start passive domain intelligence.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive subdomain discovery without using external APIs?▼

Passive subdomain discovery without external APIs is done by querying Certificate Transparency logs via crt.sh to enumerate subdomains for a target domain. This approach avoids active scanning while still mapping infrastructure.

Can I gather DNS records and WHOIS data for multiple domains in bulk?▼

Yes, you can gather DNS records and WHOIS data for multiple domains in bulk. The tool supports bulk multi-domain analysis with parallel processing to collect A, AAAA, MX, NS, TXT, and CNAME records across many targets.

Does this domain intelligence tool require any Python dependencies?▼

No, this domain intelligence tool requires zero dependencies. It is built entirely on the Python standard library, allowing you to run WHOIS lookups, DNS queries, and TLS certificate inspections without installing any external packages.

How do I inspect SSL certificate details like expiry dates and issuers?▼

Inspecting SSL certificate details like expiry dates and issuers is done by passively connecting to the target domain to extract TLS certificate metadata. This includes retrieving Subject Alternative Names and issuer information.

What is the best way to get deterministic JSON output for domain reconnaissance?▼

The best way to get deterministic JSON output for domain reconnaissance is to use command-line workflows built on Python stdlib. This ensures consistent, parseable JSON results for DNS records, WHOIS data, and subdomain discovery.

Related Skills

Explore More Data & Analytics Skills→
AIDotNetAIDotNet
84

code-formatter

Format Python and JSON source files with Black.

Official
Intermediate
eddieluengeddielueng
1

domain-intel

Collect subdomains, DNS records, TLS metadata, and WHOIS signals for a domain.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
luisgustavooliveiraluisgustavooliveira

Recon

Perform passive and active infrastructure reconnaissance using DNS, WHOIS, and IPInfo.

Community
Advanced