domain-intel

Name: domain-intel
Availability: InStock
Author: icyzh

Query certificate transparency logs, WHOIS servers, and DNS records for passive domain reconnaissance.

1|Updated Jul 31, 2026

Search Tags:#security #reconnaissance #dns #ssl #osint #whois

Ready to run

npx skills add https://github.com/icyzh/hermes-web --skill domain-intel-icyzh

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/icyzh/hermes-web/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/icyzh/hermes-web --skill domain-intel-icyzh

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This skill provides a fast, reliable way to perform passive reconnaissance on domains without triggering security alerts or requiring external API keys.

Core Features & Use Cases

Subdomain Discovery: Identify subdomains using Certificate Transparency logs.
Infrastructure Analysis: Inspect SSL certificates, WHOIS registration data, and DNS records.
Use Case: Quickly verify the ownership, security posture, and DNS configuration of a target domain during a security assessment or project onboarding.

Quick Start

Use the domain-intel skill to perform a full DNS and SSL check on example.com.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform passive domain reconnaissance without triggering security alerts?▼

Passive domain reconnaissance queries certificate transparency logs, WHOIS servers, and DNS records to gather infrastructure data without actively scanning the target or requiring external API keys.

Can I use this OSINT tool to discover subdomains from SSL certificate logs?▼

Yes, OSINT subdomain discovery works by querying certificate transparency logs to identify subdomains associated with the target domain's SSL certificates.

Does this DNS and WHOIS lookup tool require any external dependencies on Linux or Windows?▼

No, the DNS and WHOIS lookup tool requires zero dependencies. It operates using standard library networking modules to ensure execution on Linux, macOS, and Windows.

What is the best way to audit a domain's DNS configuration and security posture?▼

The best way to audit DNS configuration and security posture is to perform a combined inspection of SSL certificates, WHOIS registration data, and DNS records.

How do I check domain availability across diverse TLDs using standard networking modules?▼

You can check domain availability across diverse TLDs by querying DNS records and WHOIS servers directly through standard library networking modules.

Are there limitations to using passive reconnaissance for infrastructure auditing?▼

Yes, passive reconnaissance limitations include relying solely on historical data like certificate transparency logs and WHOIS records, which may not reflect real-time infrastructure changes.