[slavaolesik]

Pull Request

Description

Adds one line to offensive-osint §28.2 (Certificates & CT Monitoring): a keyword search over newly registered domains. CT logs only show a lookalike domain once it has a certificate. This search finds domains registered in the last 1 to 7 days across 1,100+ TLDs whether or not they have one. It is keyless and returns JSON.

Type of change

• Wordlist / catalog expansion (non-breaking)

Affected skills

• offensive-osint

Affected sections (if applicable)

• arsenal §28.2

Checklist

• My change is OSINT-only (no active exploitation, post-exploit, malware tradecraft).
• No client/engagement identifiers in the diff (scripts/scan_identifiers.py passes).
• I updated CHANGELOG.md under [Unreleased].
• My commits follow the format <type>(<scope>): <subject>.

Not applicable: no new section, skill, trigger or capability, so README tables, frontmatter triggers, smoke-test prompts and doc counts are unchanged.

Sample prompt that exercises this change

Find domains registered this week that look like the ACME brand.

Expected response

§28.2 now offers the NetAPI search next to crt.sh and CertStream. The model runs the curl with q=acme&days=7 and lists the matches, including ones that have no certificate yet.

Additional notes

Disclosure: I run NetAPI.

Slava