domain-intel

Enumerate subdomains, inspect SSL certificates, fetch WHOIS, and resolve DNS with Python stdlib.

Updated Mar 24, 2026

Search Tags:#dns #ssl #osint #whois #subdomains #domain-intel #passive

Ready to run

npx skills add https://github.com/1thirteeng3/greenmoire --skill domain-intel-1thirteeng3

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/1thirteeng3/greenmoire/tree/main/integrations/hermes-agent/skills/research/domain-intel
Command: npx skills add https://github.com/1thirteeng3/greenmoire --skill domain-intel-1thirteeng3

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Enables teams to gather domain intelligence without relying on external APIs or paid services, reducing cost and vendor lock-in.

Core Features & Use Cases

Passive subdomain discovery using Certificate Transparency logs to map domain exposure.
TLS/SSL certificate inspection for expiry, cipher suites, SANs, and issuer information.
WHOIS lookups and DNS records (A/AAAA/MX/NS/TXT/CNAME) retrieval, plus bulk multi-domain analysis.
Outputs structured JSON suitable for automation and integration into security workflows.
Use Case: Assess a domain portfolio for exposure and continuous monitoring through periodic passive checks.

Quick Start

Scan a domain to enumerate subdomains, inspect SSL certificates, perform WHOIS lookups, resolve DNS, and check domain availability.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enumerate subdomains without using external APIs?▼

You can enumerate subdomains passively using Certificate Transparency logs. This approach maps domain exposure by querying public CT log data to discover issued certificates and associated subdomains without requiring any API keys or paid services.

What is passive domain intelligence gathering and how does it work?▼

Passive domain intelligence gathering collects public infrastructure data like DNS records, WHOIS information, and SSL certificates. It uses Python's standard library and DoH-based DNS queries to inspect domain exposure risk without sending active probes to the target servers.

Can I perform SSL certificate inspection to check expiry and SANs in bulk?▼

Yes, you can inspect TLS/SSL certificates across multiple domains in bulk. The process retrieves certificate expiry dates, cipher suites, Subject Alternative Names (SANs), and issuer information to support continuous monitoring of a domain portfolio.

Do I need to install Python packages or API keys to fetch WHOIS data and resolve DNS?▼

No, you do not need to install Python packages or configure API keys. The workflow operates with zero dependencies by using only the Python standard library to perform DoH-based DNS queries, WHOIS lookups, and certificate retrieval in a cross-platform environment.

What is the best way to retrieve DNS A, MX, and TXT records for risk assessment?▼

The best way to retrieve DNS A, AAAA, MX, NS, TXT, and CNAME records for risk assessment is using a dependency-free Python stdlib workflow. It queries public data sources via DNS over HTTPS (DoH) and outputs structured JSON suitable for security automation.

What are the limitations of using Certificate Transparency logs for subdomain discovery?▼

A limitation of using Certificate Transparency logs for subdomain discovery is that it only reveals subdomains with issued SSL certificates. Subdomains without certificates remain hidden, meaning this passive method maps known exposure but may not provide a complete infrastructure inventory.