skills.rest
80portisfound
80portisfoundCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

domain-intel

Performs passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS lookups, and DNS queries.

Updated May 3, 2026
Search Tags:#reconnaissance#subdomain discovery#osint#domain availability#whois#ssl certificate#dns records
One-click install
npx skills add https://github.com/80portisfound/vibe-learning --skill domain-intel-80portisfound
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/80portisfound/vibe-learning/tree/main/packages/hermes/optional-skills/research/domain-intel
Command: npx skills add https://github.com/80portisfound/vibe-learning --skill domain-intel-80portisfound

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Gathering infrastructure intelligence about domains—subdomains, SSL certificate status, WHOIS registration, and DNS records—normally requires multiple paid tools or API keys. This Skill performs all of these passive OSINT checks using only the Python standard library, with zero dependencies and zero API keys. ## Core Features & Use Cases - Subdomain Discovery: Enumerate subdomains from Certificate Transparency logs via crt.sh, filtering out expired certificates. - SSL Certificate Inspection: Check certificate expiry, issuer, SANs, TLS version, and cipher suite with clear status warnings (OK, WARNING, CRITICAL, EXPIRED). - WHOIS & DNS Lookups: Query 100+ TLD WHOIS servers for registrar and registration dates, and resolve A, AAAA, MX, NS, TXT, and CNAME records via system DNS and Google DNS-over-HTTPS. - Availability & Bulk Checks: Estimate domain availability from three passive signals and run parallel multi-check analysis across up to 20 domains. - Use Case: Before acquiring a domain for a new project, run the availability check on several candidates, then inspect SSL expiry dates and subdomains of a competitor's infrastructure—all from one CLI with structured JSON output. ## Quick Start Ask the AI to find all subdomains of example.com and check when its SSL certificate expires using the domain intelligence script.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains of a domain without an API key?▼

Query Certificate Transparency logs through crt.sh, which publishes all issued TLS certificates. Run the subdomains command with the target domain to get a deduplicated list of subdomains, optionally filtering out expired certificates.

How to check SSL certificate expiry from the command line?▼

Connect to the host on port 443 with Python's ssl module and parse the certificate's notAfter field. The ssl command returns days remaining, expiry status (OK, WARNING, CRITICAL, EXPIRED), issuer, SANs, TLS version, and cipher suite.

Does this WHOIS lookup work on Windows and macOS?▼

Yes, the tool uses only Python standard library modules like socket, ssl, and urllib, so it runs identically on Linux, macOS, and Windows with no dependencies. Note that WHOIS uses TCP port 43, which some restrictive networks block.

Why does WHOIS sometimes show no registrant information?▼

Many WHOIS servers redact registrant details due to GDPR privacy regulations, and some TLDs limit published data. The tool still returns registrar, creation and expiration dates, name servers, and domain status when available.

Can a domain availability check replace a registrar API?▼

No, the availability check is heuristic-based, combining DNS resolution, WHOIS responses, and SSL reachability as three passive signals. It returns a confidence level (high, medium, low) rather than an authoritative answer like a registrar API would.

What are the limitations of passive domain reconnaissance?▼

Passive reconnaissance cannot detect hosts without certificates, and crt.sh can be slow for popular domains with thousands of certificates. The SSL check is the only active operation, connecting directly to the target on port 443.

Related Skills

Explore More Software Engineering Skills→
kmshihab7878kmshihab7878
6

osint-recon

Automate open-source intelligence collection and structured reconnaissance for usernames, domains, emails, and organizations.

Community
Advanced
Muath2000Muath2000

attack-surface-analyst

Discover and monitor internet-facing assets for external attack surface management.

Community
Advanced
subimagesecsubimagesec

investigate-ip

Resolve IP and domain ownership across AWS, GCP, and Azure resources.

Official
Advanced
azaanalirazaazaanaliraza

domain-intel

Performs passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS lookups, and DNS queries.

Community
Intermediate