domain-intel

Conduct passive domain reconnaissance using Python stdlib and output JSON.

Updated Aug 23, 2026
One-click install
npx skills add https://github.com/AlexKoncept/omnia-hub --skill domain-intel-alexkoncept
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/AlexKoncept/omnia-hub/tree/main/HERMES/optional-skills/research/domain-intel
Command: npx skills add https://github.com/AlexKoncept/omnia-hub --skill domain-intel-alexkoncept

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance using Python stdlib to gather subdomain data, TLS info, WHOIS records, DNS data, and domain availability signals without external APIs.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs
  • SSL certificate inspection (expiry, SANs, issuer)
  • WHOIS lookup and registrar data
  • DNS records resolution (A, AAAA, MX, NS, TXT, CNAME)
  • Domain availability assessment using passive signals
  • Bulk analysis across multiple domains

Quick Start

Run python3 SKILL_DIR/scripts/domain_intel.py subdomains example.com

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I gather passive domain reconnaissance using only Python standard library?

Passive domain reconnaissance using Python stdlib collects subdomain data, TLS information, WHOIS records, and DNS data without external APIs. It runs via a CLI script that outputs JSON, requiring no third-party dependencies.

Can I find subdomains and check SSL certificate details without installing external packages?

Yes, subdomain discovery and SSL certificate inspection are performed using Python stdlib. Subdomains are found via Certificate Transparency logs, and SSL checks extract expiry, SANs, and issuer data without external packages.

How do I resolve DNS records like A, MX, and TXT for bulk domain analysis?

DNS records including A, AAAA, MX, NS, TXT, and CNAME are resolved using the Python stdlib. The script supports bulk analysis across multiple domains, outputting the resolved DNS data as structured JSON.

Does passive OSINT domain intelligence work across Linux, macOS, and Windows?

Passive OSINT domain intelligence works across Linux, macOS, and Windows. Because it relies entirely on the Python standard library, it functions consistently across these operating systems without requiring platform-specific dependencies.

What is the best way to check domain availability using passive signals?

Domain availability assessment is conducted using passive signals gathered through the Python stdlib. By analyzing DNS records and WHOIS registrar data, the script determines availability without sending active probing requests to the target.

Do I need external API keys to perform WHOIS lookups and domain intelligence gathering?

No external API keys are needed for WHOIS lookups or domain intelligence gathering. The implementation uses Python stdlib to retrieve registrar data and perform all passive reconnaissance tasks independently.