skills.rest
gigagiova
gigagiovaCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Collect subdomains, SSL details, WHOIS, DNS, and availability using Python stdlib.

Updated Mar 2, 2026
Search Tags:#dns#ssl#domain#osint#whois#subdomains
One-click install
npx skills add https://github.com/gigagiova/hermes-agent --skill domain-intel-gigagiova
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/gigagiova/hermes-agent/tree/main/skills/domain/domain-intel
Command: npx skills add https://github.com/gigagiova/hermes-agent --skill domain-intel-gigagiova

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive OSINT for domain intelligence using Python stdlib, enabling subdomain discovery, SSL certificate inspection, WHOIS lookups, DNS records, and domain availability checks without API keys.

Core Features & Use Cases

  • Passive subdomain discovery via Certificate Transparency logs (crt.sh)
  • SSL certificate inspection (expiry, issuer, SANs)
  • WHOIS lookups (registrar, creation date, name servers)
  • DNS records resolution (A, AAAA, MX, NS, TXT, CNAME)
  • Domain availability signals combining DNS, WHOIS, and TLS checks
  • Bulk analysis across multiple domains for rapid triage

Quick Start

Run domain_intel.py to gather subdomains, SSL details, WHOIS info, DNS records, and domain availability signals for a target domain.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I gather passive OSINT for a domain without API keys?▼

You can gather passive domain OSINT by running a Python script that queries Certificate Transparency logs, WHOIS databases, and DNS servers to collect subdomains, SSL details, and DNS records without requiring external API keys.

How do I find subdomains using Certificate Transparency logs?▼

Subdomain discovery uses Certificate Transparency logs via crt.sh to passively enumerate subdomains. This approach queries public SSL certificate issuance records to identify subdomains without actively scanning the target domain.

Can I perform bulk domain intelligence analysis across multiple domains?▼

Yes, you can perform bulk domain intelligence analysis across multiple domains. The script parallelizes sub-tasks to rapidly triage domain exposure, collecting SSL, WHOIS, and DNS data simultaneously for each target.

What DNS records can I resolve using only Python stdlib?▼

Using only Python stdlib, you can resolve A, AAAA, MX, NS, TXT, and CNAME DNS records for target domains. This dependency-free execution eliminates the need to install external DNS resolution libraries.

Does passive domain intelligence work on Linux, macOS, and Windows?▼

Passive domain intelligence execution is compatible with Linux, macOS, and Windows environments. The cross-platform compatibility is achieved by relying solely on built-in Python standard library modules.

What is included in an SSL certificate inspection for domain exposure?▼

SSL certificate inspection extracts certificate expiry dates, issuer information, and Subject Alternative Names (SANs). These details help identify domain exposure and assess the security posture of TLS configurations.

Related Skills

Explore More Data & Analytics Skills→
jason660519jason660519

domain-intel

Perform passive OSINT on domains using only Python stdlib.

Community
Intermediate
ever-oliever-oli
3

domain-intel

Collect passive domain intelligence via subdomains, SSL, WHOIS, DNS, and availability.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
AeonDaveAeonDave
15

sublist3r

Enumerate subdomains passively via OSINT sources with optional brute-force wordlists.

Community
Intermediate