domain-intel

Performs passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS, and DNS lookups.

Updated Jul 7, 2026
One-click install
npx skills add https://github.com/episvr/USTB-2026-SummerInternship --skill domain-intel-episvr
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/episvr/USTB-2026-SummerInternship/tree/main/hermes-config/optional-skills/research/domain-intel
Command: npx skills add https://github.com/episvr/USTB-2026-SummerInternship --skill domain-intel-episvr

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Gathering infrastructure intelligence about domains—subdomains, SSL certificate status, WHOIS registration, and DNS records—normally requires multiple paid tools or API keys. This Skill performs all of these passive OSINT checks using only the Python standard library, with zero dependencies and zero API keys. ## Core Features & Use Cases - Subdomain Discovery: Enumerate subdomains from Certificate Transparency logs via crt.sh, filtering out expired certificates. - SSL & WHOIS Inspection: Check TLS certificate expiry, cipher suites, and SANs, plus registrar, creation, and expiration dates across 100+ TLD WHOIS servers. - DNS & Availability Checks: Resolve A, AAAA, MX, NS, TXT, and CNAME records, and heuristically determine whether a domain is available for registration. - Bulk Analysis: Run multiple checks across up to 20 domains in parallel with structured JSON output. - Use Case: Before acquiring a domain for a new project, run the availability check on several candidates, then inspect the SSL expiry dates of competitor domains in one bulk command. ## Quick Start Ask the AI to find all subdomains of example.com and check when its SSL certificate expires using the domain-intel skill.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains of a domain without API keys?▼

Query Certificate Transparency logs through crt.sh, which publishes all issued TLS certificates. The domain_intel.py script fetches these entries over HTTPS, filters expired certificates, and returns a deduplicated list of subdomains as JSON.

How to check SSL certificate expiration from the command line?▼

Run the ssl command of domain_intel.py with the target hostname. It connects to port 443, parses the certificate's notAfter date, and reports days remaining with a status of OK, WARNING, CRITICAL, or EXPIRED.

Does this WHOIS lookup work on Windows and macOS?▼

Yes, the script uses only Python standard library modules like socket, ssl, and urllib, so it runs identically on Linux, macOS, and Windows. Note that WHOIS queries use TCP port 43, which some restrictive networks block.

Why does WHOIS sometimes return no registrant information?▼

Many WHOIS servers redact registrant details due to GDPR privacy regulations. The lookup still returns registrar, dates, and name servers when available, but personal contact fields may be omitted by the registry.

Is the domain availability check authoritative?▼

No, it is a heuristic combining three passive signals: DNS records, WHOIS responses, and SSL reachability. It returns a verdict with a confidence level, but only a registrar API can authoritatively confirm availability.

What are the limitations of passive domain reconnaissance?▼

Passive reconnaissance avoids port scanning and vulnerability probing, so it cannot detect open services beyond SSL on port 443. crt.sh can also be slow for popular domains with thousands of certificates, and results are capped at 200 subdomains.