skills.rest
kwasi-cpu
kwasi-cpuCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Perform passive domain reconnaissance with Python's standard library.

Updated Aug 23, 2026
Search Tags:#reconnaissance#dns#ssl#domain#osint#whois
One-click install
npx skills add https://github.com/kwasi-cpu/hermes-agent --skill domain-intel
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/kwasi-cpu/hermes-agent/tree/main/skills/research/domain-intel
Command: npx skills add https://github.com/kwasi-cpu/hermes-agent --skill domain-intel

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill automates passive domain reconnaissance, gathering crucial information about domains without requiring any API keys or external services, making it accessible and cost-effective.

Core Features & Use Cases

  • Subdomain Discovery: Identifies subdomains using Certificate Transparency logs.
  • SSL Certificate Inspection: Checks certificate expiry, issuer, and subject alternative names.
  • WHOIS Lookups: Retrieves registration details, registrar information, and name servers.
  • DNS Record Resolution: Fetches A, AAAA, MX, NS, TXT, and CNAME records.
  • Domain Availability: Assesses domain availability based on passive DNS, WHOIS, and SSL signals.
  • Bulk Analysis: Performs multiple checks across multiple domains concurrently.
  • Use Case: A security analyst needs to quickly assess the digital footprint of a newly acquired company. This Skill can rapidly provide a list of subdomains, SSL certificate details, and WHOIS information for all associated domains.

Quick Start

Use the domain-intel skill to find subdomains for example.com.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains without an API key?▼

You can perform subdomain discovery without an API key by querying Certificate Transparency logs through crt.sh. The Skill uses Python's standard library to fetch this data, requiring no external services.

How does passive DNS resolution fetch MX and TXT records?▼

Passive DNS resolution fetches MX and TXT records by querying Google DNS-over-HTTPS. It retrieves A, AAAA, NS, and CNAME records using Python's standard library, avoiding external DNS client dependencies.

Can I check SSL certificate expiry and issuer details in bulk?▼

You can check SSL certificate expiry and issuer details in bulk. The Skill performs concurrent analysis across multiple domains, inspecting certificate expiration and subject alternative names simultaneously.

What is the best way to do a WHOIS lookup for domain availability?▼

The best way to do a WHOIS lookup for domain availability is to query WHOIS servers directly. The Skill assesses availability by combining passive DNS signals, WHOIS registration details, and SSL certificate data.

Can I use Python's standard library for OSINT domain reconnaissance?▼

Yes, you can use Python's standard library for OSINT domain reconnaissance. The Skill performs subdomain discovery, SSL inspection, and WHOIS lookups relying solely on built-in modules and sources like crt.sh.

Related Skills

Explore More Software Engineering Skills→
thisismynewfmail-uithisismynewfmail-ui

domain-intel

Identify subdomains, SSL certificates, WHOIS data, DNS records, and domain availability.

Community
Intermediate
ragnarokhaaragnarokhaa
4

domain-intel

Identify subdomains, SSL details, WHOIS data, and DNS records using Python stdlib.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
anysearch-aianysearch-ai
5.3k

anysearch

Integrate a real-time search engine for AI agents via JSON-RPC API.

Community
Advanced