domain-intel

Name: domain-intel
Availability: InStock
Author: alvarobiano

Identify subdomains, SSL certificates, WHOIS, DNS records, and domain availability using Python's standard library.

Updated May 2, 2026

Search Tags:#dns #ssl #domain #osint #whois #subdomains #bulk-analysis

Ready to run

npx skills add https://github.com/AlvaroBiano/hermes-agent --skill domain-intel-alvarobiano

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/AlvaroBiano/hermes-agent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/AlvaroBiano/hermes-agent --skill domain-intel-alvarobiano

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance using Python's standard library with zero dependencies, enabling quick gathering of domain intelligence without relying on external APIs.

Core Features & Use Cases

Subdomain discovery using Certificate Transparency logs via standard library JSON handling
SSL certificate inspection, expiry checks, and issuer information
WHOIS lookups for registrar, creation/expiration dates, and nameservers
DNS records resolution (A, AAAA, MX, NS, TXT, CNAME) with DoH fallback
Domain availability signals based on DNS, WHOIS, and TLS reachability
Bulk analysis across multiple domains with parallel execution

Quick Start

Run the domain_intel.py CLI against a target domain to fetch subdomains, SSL data, WHOIS, DNS records, and availability in a single JSON payload.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I gather domain intelligence like WHOIS and DNS records without external APIs?▼

Domain intelligence gathering without external APIs is achievable using Python's standard library to fetch WHOIS data, DNS records, and SSL certificates. This approach queries Certificate Transparency logs and applies DNS-over-HTTPS fallbacks to return structured JSON results.

What is passive OSINT subdomain discovery and how does it work?▼

Passive OSINT subdomain discovery identifies subdomains without actively scanning the target by querying Certificate Transparency logs. It uses Python's built-in JSON handling to parse log entries, extracting subdomains safely and deterministically without sending direct probe traffic to the target.

Can I run bulk domain analysis for DNS and SSL certificate checks using pure Python?▼

Bulk domain analysis for DNS and SSL certificate checks is supported using a pure-Python CLI script. It executes parallel queries across multiple domains, aggregating subdomains, TLS data, and WHOIS information into a single structured JSON payload for downstream processing.

Do I need to install any dependencies to perform WHOIS lookups and DNS resolution?▼

No dependencies are required to perform WHOIS lookups and DNS resolution. The tool operates entirely on Python's standard library, requiring no external API keys or third-party packages, ensuring deterministic, dependency-free results across any environment.

What DNS record types can I resolve using a dependency-free Python script?▼

You can resolve A, AAAA, MX, NS, TXT, and CNAME DNS record types using the dependency-free Python script. It performs standard resolution with a DNS-over-HTTPS fallback mechanism to ensure reliable retrieval of domain records within a structured JSON output.

When should I not use passive domain reconnaissance for availability checks?▼

Passive domain reconnaissance should not be used when you need real-time active scanning or guaranteed port discovery. Availability signals are inferred passively from DNS, WHOIS, and TLS reachability data, which may not reflect transient network outages or active firewall blocks.