site-analyze_skill

Overview

This skill performs a full-spectrum infrastructure analysis for any website, producing a concise provenance report that helps identify hosting, CDN use, origin IPs, routing, latency, SSL details, and discovered subdomains. It requires no API keys and runs from networks with outbound HTTPS, using DNS-over-HTTPS probes and standard OS tools to build a practical, action-oriented trace.

How this skill works

The tool runs a pipeline of modules: auto-detects working DoH servers, performs multi-resolver DNS queries, maps IPs to ASN/CDN data, enumerates subdomains via DoH and CT logs, measures TCP and HTTP(S) latency and timings, retrieves HTTP headers and SSL certificate details, and runs TCP traceroutes. It correlates results to flag non-CDN origin candidates, anycast behavior, and CDN PoPs, then emits a readable verdict with remediation or investigative suggestions.

When to use it

• Investigating where a website is hosted or which CDN fronts it
• Verifying whether a subdomain leaks an origin IP outside the CDN
• Assessing routing, latency, and potential geographic bias of edge vs origin
• Auditing SSL certificate validity and issuer details
• Troubleshooting HTTP(S) response headers or caching behavior

Best practices

• Run from a machine with unrestricted outbound HTTPS to ensure DoH and curl work reliably
• Use multiple runs from different networks to reveal geo-distributed edge behavior versus origin
• Combine TCP latency and TTFB values to distinguish anycast edge from true origin distance
• Inspect starred subdomains (non-CDN IPs) carefully as likely origin hosts
• Ensure curl, openssl, and tcptraceroute/traceroute are installed for full diagnostics

Example use cases

• Detect if Cloudflare, Akamai, Fastly, AWS, Aliyun, or Tencent CDN is fronting a domain
• Find candidate origin servers by locating subdomains that resolve to non-CDN IPs
• Measure TCP and TLS timing breakdowns to estimate edge vs origin RTT and detect anycast
• Extract HTTP headers like CF-RAY or x-cache to identify PoP and cache behavior
• Generate an actionable summary that flags origin findings and suggests investigative next steps