domain-intel

Name: domain-intel
Availability: InStock
Author: Khyro

Map passive domain intelligence via subdomain, SSL, WHOIS, and DNS lookups.

Updated Apr 2, 2026

Search Tags:#dns #ssl certificates #osint #whois #subdomains #domain intelligence

Ready to run

npx skills add https://github.com/JKhyro/HERMES-AGENT --skill domain-intel-jkhyro

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/JKhyro/HERMES-AGENT/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/JKhyro/HERMES-AGENT --skill domain-intel-jkhyro

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

It removes the manual work of collecting passive domain intelligence when you need to understand how a domain is configured, who registered it, and what infrastructure it exposes.

Core Features & Use Cases

Subdomain discovery from Certificate Transparency logs for mapping an organization’s exposed surface.
SSL certificate inspection for expiry, issuer, SANs, TLS version, and cipher details.
WHOIS and DNS lookup for registrar, dates, name servers, and common record types.
Domain availability heuristics for quickly checking whether a name is likely registered or free.
Use case: A security researcher can triage a client domain, confirm certificate health, list subdomains, and gather registration metadata before a review.

Quick Start

Ask the skill to analyze example.com and return passive subdomains, SSL details, WHOIS data, DNS records, and an availability verdict.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I gather passive domain intelligence without active scanning?▼

Passive domain intelligence is gathered by querying Certificate Transparency logs, WHOIS databases, and DNS-over-HTTPS without sending active probe packets to the target host.

What is the best way to find subdomains using SSL certificate logs?▼

Finding subdomains using SSL certificate logs involves querying Certificate Transparency data sources like crt.sh to enumerate hostnames associated with a target domain's issued certificates.

Can I check SSL certificate details and DNS records without API keys?▼

Checking SSL certificate details and DNS records without API keys is possible using Python standard library networking combined with Google DNS-over-HTTPS and crt.sh for structured JSON output.

How do I perform a WHOIS lookup and retrieve registrar data for a domain?▼

Performing a WHOIS lookup queries registration databases to retrieve registrar information, creation and expiration dates, and name servers mapped to the requested target domain.

Does passive OSINT domain triage require third-party Python packages?▼

Passive OSINT domain triage requires no third-party Python packages, relying entirely on the Python standard library to resolve DNS records and inspect SSL certificates.

What limitations exist when mapping subdomains through Certificate Transparency?▼

Mapping subdomains through Certificate Transparency is limited to hostnames included in issued certificates, meaning internal or un-certified subdomains will not appear in the query results.