skills.rest
azaanaliraza
azaanalirazaCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Performs passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS lookups, and DNS queries.

Updated Apr 18, 2026
Search Tags:#domain reconnaissance#subdomain discovery#osint#whois#ssl certificate#dns records#passive scanning
One-click install
npx skills add https://github.com/azaanaliraza/operarius --skill domain-intel-azaanaliraza
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/azaanaliraza/operarius/tree/main/src-tauri/bin/hermes/optional-skills/research/domain-intel
Command: npx skills add https://github.com/azaanaliraza/operarius --skill domain-intel-azaanaliraza

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Gathering domain infrastructure intelligence normally requires multiple paid tools or API keys. This Skill performs passive OSINT reconnaissance on any domain using only Python's standard library, with no dependencies, no API keys, and no active scanning. ## Core Features & Use Cases - Subdomain Discovery: Enumerate subdomains from Certificate Transparency logs via crt.sh, filtering out expired certificates. - SSL & WHOIS Inspection: Check TLS certificate expiry, cipher suites, and issuers, plus registrar, creation, and expiration dates across 100+ TLD WHOIS servers. - DNS & Availability Checks: Resolve A, AAAA, MX, NS, TXT, and CNAME records, and estimate domain availability from three passive signals. - Use Case: Before acquiring a domain for a new product, run a bulk check across candidate names to see which are registered, inspect a competitor's SSL certificate expiry, and map their subdomain footprint. ## Quick Start Ask the assistant to find all subdomains of example.com and check when its SSL certificate expires using the domain intelligence skill.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains of a domain without API keys?▼

Query Certificate Transparency logs through crt.sh, which publishes all issued TLS certificates. The subdomains command fetches these entries over HTTPS, filters expired certificates, and returns a deduplicated list of subdomain names.

How to check when an SSL certificate expires?▼

Connect to the host on port 443 and inspect the TLS certificate's notAfter field. The ssl command returns days remaining, expiry status, issuer, subject alternative names, TLS version, and cipher suite as structured JSON.

Does this domain reconnaissance tool work on Windows and macOS?▼

Yes, it uses only Python standard library modules like socket, ssl, urllib, and json, so it runs identically on Linux, macOS, and Windows. No pip installs or platform-specific binaries are required.

Why does WHOIS lookup fail on some networks?▼

WHOIS queries use TCP port 43, which is frequently blocked by corporate firewalls and restrictive networks. DNS-based checks still work because they use Google DNS-over-HTTPS on port 443.

Is the domain availability check accurate?▼

The availability check is heuristic, combining three passive signals: DNS records, WHOIS responses, and SSL reachability. It returns a confidence level but is not authoritative like a registrar API, so confirm with a registrar before purchasing.

Related Skills

Explore More Software Engineering Skills→
serankingseranking
116

seo-competitor-gap-analysis

Identify keywords a target domain misses relative to top organic competitors.

Official
Advanced
Monjyu1101Monjyu1101
1

domain-intel

Performs domain intelligence using only Python's standard library.

Community
Intermediate
orthogonal-shorthogonal-sh
12

tomba

Find and verify contact emails from domains, LinkedIn profiles, or company searches.

Official
Advanced
SignmanalSignmanal
1

domain-intel

Collect subdomains, SSL certificates, WHOIS, and DNS records as JSON.

Community
Intermediate