skills.rest
eddielueng
eddieluengCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Collect subdomains, DNS records, TLS metadata, and WHOIS signals for a domain.

1|Updated Apr 14, 2026
Search Tags:#domain reconnaissance#subdomain discovery#osint#domain availability#dns records#whois lookup#tls certificate
One-click install
npx skills add https://github.com/eddielueng/hermes-agent-zh --skill domain-intel-eddielueng
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/eddielueng/hermes-agent-zh/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/eddielueng/hermes-agent-zh --skill domain-intel-eddielueng

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and assets (resource) components.

What problem does it solve?

This Skill helps you quickly gather actionable intelligence about a domain by collecting subdomains, DNS records, TLS certificate details, and WHOIS registration signals without requiring API keys or heavy dependencies.

Core Features & Use Cases

  • Passive subdomain reconnaissance: Retrieves subdomains from Certificate Transparency logs to support infrastructure discovery and assessment.
  • TLS certificate inspection: Connects to the target on port 443 to extract issuer, SANs, protocol, cipher, and expiry status.
  • WHOIS + DNS + availability heuristic: Queries WHOIS (TCP/43) and DNS (system + Google DoH) and combines signals to estimate whether a domain appears available.
  • Bulk analysis: Runs multiple checks across multiple domains in parallel and returns structured JSON output you can process downstream.
  • Use case: Before setting up monitoring or investigating an organization's online presence, discover related hosts, confirm certificate configuration, and check whether a target domain is likely registered.

Quick Start

Ask the agent to run domain-intel for ssl and dns on example.com and return the results as JSON.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains using Certificate Transparency logs?▼

Passive subdomain discovery queries Certificate Transparency logs like crt.sh to retrieve historical TLS issuance records, revealing registered subdomains. This Skill automates that reconnaissance process, returning structured JSON output for infrastructure mapping without requiring external API keys.

How do I check TLS certificate expiry and SANs for a domain?▼

To check TLS certificate expiry and SANs, establish a TCP connection to port 443 and inspect the returned certificate metadata. This Skill performs that TLS inspection automatically, extracting issuer details, protocol versions, cipher suites, and expiry status for security and ops workflows.

Can I run bulk DNS and WHOIS lookups across multiple domains without API keys?▼

Yes, bulk DNS and WHOIS queries can run across multiple domains without API keys by using Python stdlib. This Skill queries WHOIS over TCP/43 and DNS via Google DoH in parallel, combining signals to estimate domain availability and return structured JSON reports.

What is the best way to estimate domain availability using DNS and WHOIS data?▼

Estimating domain availability requires combining WHOIS registration records with DNS resolution signals to infer registration status. This Skill queries WHOIS over TCP/43 and Google DoH simultaneously, applying a heuristic to estimate whether a target domain appears actively registered.

Does passive domain reconnaissance require any external dependencies or tools?▼

Passive domain reconnaissance with this approach requires no external dependencies or API keys, relying entirely on Python stdlib. It queries public services like crt.sh for certificates and Google DoH for DNS, returning JSON-structured outputs for downstream security workflows.

Related Skills

Explore More Education & Research Skills→
Quill-AgentQuill-Agent
3

domain-intel

Perform passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS, DNS records, and availability checks.

Community
Advanced
KarlinskySKarlinskyS

domain-intel

Perform passive domain intelligence using only Python stdlib.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
GarrettRoiGarrettRoi

domain-intel

Perform passive domain reconnaissance via Certificate Transparency, SSL, WHOIS, and DNS checks.

Community
Intermediate