skills.rest
carterwayneskhizeine
carterwayneskhizeineCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Collect subdomains, TLS certificates, WHOIS signals, and DNS records for domains.

19|4|Updated Apr 22, 2026
Search Tags:#availability check#domain#osint#whois#subdomains#dns records#tls certificate
One-click install
npx skills add https://github.com/carterwayneskhizeine/hermes-agent-windows-R --skill domain-intel-carterwayneskhizeine
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/carterwayneskhizeine/hermes-agent-windows-R/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/carterwayneskhizeine/hermes-agent-windows-R --skill domain-intel-carterwayneskhizeine

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps you gather passive intelligence about domains—such as subdomains, TLS certificate details, WHOIS registration signals, and DNS records—so you can assess what’s publicly exposed without needing external API keys.

Core Features & Use Cases

  • Subdomain discovery (passive): Pull likely subdomains from Certificate Transparency logs, useful for mapping an attack surface or understanding the breadth of a domain’s HTTPS presence.
  • TLS certificate inspection: Retrieve certificate metadata like issuer, SANs, and expiry status, useful for security posture reviews and identifying certificate rotation or misconfiguration patterns.
  • WHOIS + DNS + availability heuristics: Collect registrar-related signals and DNS records, then estimate whether a domain appears registered or available for onboarding/research.
  • Bulk multi-domain analysis: Run multiple checks across multiple domains concurrently, useful when you need a fast reconnaissance snapshot for a list of domains.

Quick Start

Ask the assistant to run Domain Intelligence and return JSON results for DNS records and TLS details for example.com by executing: python3 SKILL_DIR/scripts/domain_intel.py bulk example.com --checks ssl,dns

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without API keys?▼

Passive domain reconnaissance without API keys is done by querying Certificate Transparency logs via crt.sh over HTTPS, resolving DNS through system DNS and Google DoH, and checking WHOIS via TCP port 43 to gather structured JSON output.

Can I check TLS certificate details and subdomains for multiple domains at once?▼

Yes, bulk multi-domain analysis runs concurrent checks across multiple domains to collect TLS certificate metadata, subdomains from Certificate Transparency logs, and DNS records, outputting a fast reconnaissance snapshot in structured JSON.

What DNS records and WHOIS signals are retrieved during a domain availability check?▼

A domain availability check retrieves registrar-related WHOIS signals via TCP port 43 and standard DNS records resolved through system DNS and Google DoH, applying heuristics to estimate whether a domain appears registered or available.

How does subdomain discovery from Certificate Transparency logs work?▼

Subdomain discovery works by querying crt.sh over HTTPS to pull historical TLS certificate issuance data, mapping the breadth of a domain's HTTPS presence and exposing likely subdomains without active scanning or API authentication.

Do I need to install external Python packages to run domain intelligence scripts?▼

No, the domain intelligence CLI requires only Python standard library modules, executing scripts directly via python3 to query crt.sh, resolve DNS, and fetch WHOIS data without installing any external dependencies.

What is the best way to monitor TLS certificate expiry for infrastructure research?▼

Monitoring TLS certificate expiry is best achieved by retrieving certificate metadata like issuer, SANs, and expiry status from crt.sh queries, identifying rotation patterns or misconfigurations across single or bulk domain targets.

Related Skills

Explore More Education & Research Skills→
twjarviszyra-webtwjarviszyra-web
3

domain-intel

Extract subdomains, DNS records, WHOIS data, and SSL certificate details from domains.

Community
Intermediate
eddieluengeddielueng
1

domain-intel

Collect subdomains, DNS records, TLS metadata, and WHOIS signals for a domain.

Community
Intermediate
zerwizzerwiz

domain-intel

Your AI-powered command and data center for domain intelligence, delivering instant situational awareness and automated reporting to accelerate your next move.

Community
Intermediate
madsstoumannmadsstoumann
13

is-website-safe

Analyze website safety via WHOIS, DNS, and Trustpilot reviews.

Community
Advanced