domain-intel

Identify passive domain intelligence data using Python's standard library.

Updated Apr 19, 2026
One-click install
npx skills add https://github.com/gqf2008/hermez-ai --skill domain-intel-gqf2008
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/gqf2008/hermez-ai/tree/main/skills/research/domain-intel
Command: npx skills add https://github.com/gqf2008/hermez-ai --skill domain-intel-gqf2008

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain intelligence for quick, automated discovery and verification of domain data using only Python stdlib.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs and DNS signals
  • SSL certificate inspection (expiry, issuer, SANs)
  • WHOIS lookups for registrar and dates
  • DNS record retrieval (A, AAAA, MX, NS, TXT, CNAME)
  • Domain availability assessment via DNS, WHOIS, and SSL signals
  • Bulk analysis across multiple domains

Quick Start

Run the domain_intel.py script against a domain to perform passive OSINT using only the Python stdlib.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain intelligence gathering without external API keys?

Passive domain intelligence uses Python's standard library to query DNS, SSL, and WHOIS records directly. The script extracts subdomains, certificate details, and registrar data without external API keys by running against a target domain.

Can I discover subdomains using Certificate Transparency logs with just Python?

Subdomain discovery via Certificate Transparency logs uses Python's urllib and ssl modules. It queries public log endpoints to parse SANs from SSL certificates, returning structured JSON with identified subdomains.

How do I retrieve DNS records like A, MX, and TXT using Python stdlib?

DNS record retrieval for A, AAAA, MX, NS, TXT, and CNAME records uses Python's socket module to query nameservers. The script outputs resolved records as structured JSON data.

Does this domain OSINT approach work for bulk multi-domain analysis?

Bulk multi-domain analysis uses Python's concurrent.futures module to process multiple domains in parallel. It aggregates subdomain, SSL, WHOIS, and DNS signals for each domain into structured JSON output.

What are the limitations of relying on zero-dependency Python stdlib for WHOIS lookups?

Zero-dependency WHOIS lookups rely on standard network protocols without dedicated parsing libraries, meaning raw registrar data extraction may be less structured. Complex WHOIS responses might require manual interpretation.