skills.rest
icyzh
icyzhCOMMUNITY
Explore all skills by this author →
Website𝕏@icyzhbeGitHub

domain-intel

Query certificate transparency logs, WHOIS servers, and DNS records for passive domain reconnaissance.

1|Updated Jul 31, 2026
Search Tags:#security#reconnaissance#dns#ssl#osint#whois
One-click install
npx skills add https://github.com/icyzh/hermes-web --skill domain-intel-icyzh
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/icyzh/hermes-web/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/icyzh/hermes-web --skill domain-intel-icyzh

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This skill provides a fast, reliable way to perform passive reconnaissance on domains without triggering security alerts or requiring external API keys.

Core Features & Use Cases

  • Subdomain Discovery: Identify subdomains using Certificate Transparency logs.
  • Infrastructure Analysis: Inspect SSL certificates, WHOIS registration data, and DNS records.
  • Use Case: Quickly verify the ownership, security posture, and DNS configuration of a target domain during a security assessment or project onboarding.

Quick Start

Use the domain-intel skill to perform a full DNS and SSL check on example.com.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without triggering security alerts?▼

Passive domain reconnaissance queries certificate transparency logs, WHOIS servers, and DNS records to gather infrastructure data without actively scanning the target or requiring external API keys.

Can I use this OSINT tool to discover subdomains from SSL certificate logs?▼

Yes, OSINT subdomain discovery works by querying certificate transparency logs to identify subdomains associated with the target domain's SSL certificates.

Does this DNS and WHOIS lookup tool require any external dependencies on Linux or Windows?▼

No, the DNS and WHOIS lookup tool requires zero dependencies. It operates using standard library networking modules to ensure execution on Linux, macOS, and Windows.

What is the best way to audit a domain's DNS configuration and security posture?▼

The best way to audit DNS configuration and security posture is to perform a combined inspection of SSL certificates, WHOIS registration data, and DNS records.

How do I check domain availability across diverse TLDs using standard networking modules?▼

You can check domain availability across diverse TLDs by querying DNS records and WHOIS servers directly through standard library networking modules.

Are there limitations to using passive reconnaissance for infrastructure auditing?▼

Yes, passive reconnaissance limitations include relying solely on historical data like certificate transparency logs and WHOIS records, which may not reflect real-time infrastructure changes.

Related Skills

Explore More Software Engineering Skills→
cxnaivecxnaive

domain-intel

Perform passive domain reconnaissance using Python standard library modules.

Community
Intermediate
Devsoul2026Devsoul2026
150

domain-intel

Perform passive domain reconnaissance using Python stdlib and output JSON.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
auxi-wardrobeauxi-wardrobe
1

cti-expert

Conduct structured cyber threat intelligence and OSINT analysis on target entities.

Official
Advanced