skills.rest
JKhyro
JKhyroCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Map passive domain intelligence via subdomain, SSL, WHOIS, and DNS lookups.

Updated Apr 2, 2026
Search Tags:#dns#ssl certificates#osint#whois#subdomains#domain intelligence
One-click install
npx skills add https://github.com/JKhyro/HERMES-AGENT --skill domain-intel-jkhyro
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/JKhyro/HERMES-AGENT/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/JKhyro/HERMES-AGENT --skill domain-intel-jkhyro

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

It removes the manual work of collecting passive domain intelligence when you need to understand how a domain is configured, who registered it, and what infrastructure it exposes.

Core Features & Use Cases

  • Subdomain discovery from Certificate Transparency logs for mapping an organization’s exposed surface.
  • SSL certificate inspection for expiry, issuer, SANs, TLS version, and cipher details.
  • WHOIS and DNS lookup for registrar, dates, name servers, and common record types.
  • Domain availability heuristics for quickly checking whether a name is likely registered or free.
  • Use case: A security researcher can triage a client domain, confirm certificate health, list subdomains, and gather registration metadata before a review.

Quick Start

Ask the skill to analyze example.com and return passive subdomains, SSL details, WHOIS data, DNS records, and an availability verdict.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I gather passive domain intelligence without active scanning?▼

Passive domain intelligence is gathered by querying Certificate Transparency logs, WHOIS databases, and DNS-over-HTTPS without sending active probe packets to the target host.

What is the best way to find subdomains using SSL certificate logs?▼

Finding subdomains using SSL certificate logs involves querying Certificate Transparency data sources like crt.sh to enumerate hostnames associated with a target domain's issued certificates.

Can I check SSL certificate details and DNS records without API keys?▼

Checking SSL certificate details and DNS records without API keys is possible using Python standard library networking combined with Google DNS-over-HTTPS and crt.sh for structured JSON output.

How do I perform a WHOIS lookup and retrieve registrar data for a domain?▼

Performing a WHOIS lookup queries registration databases to retrieve registrar information, creation and expiration dates, and name servers mapped to the requested target domain.

Does passive OSINT domain triage require third-party Python packages?▼

Passive OSINT domain triage requires no third-party Python packages, relying entirely on the Python standard library to resolve DNS records and inspect SSL certificates.

What limitations exist when mapping subdomains through Certificate Transparency?▼

Mapping subdomains through Certificate Transparency is limited to hostnames included in issued certificates, meaning internal or un-certified subdomains will not appear in the query results.

Related Skills

Explore More Education & Research Skills→
twjarviszyra-webtwjarviszyra-web
3

domain-intel

Extract subdomains, DNS records, WHOIS data, and SSL certificate details from domains.

Community
Intermediate
ever-oliever-oli
3

domain-intel

Collect passive domain intelligence via subdomains, SSL, WHOIS, DNS, and availability.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
AeonDaveAeonDave
15

sublist3r

Enumerate subdomains passively via OSINT sources with optional brute-force wordlists.

Community
Intermediate