domain-intel

Perform passive domain reconnaissance using Python stdlib without API keys.

1|1|Updated May 9, 2026
One-click install
npx skills add https://github.com/ldzhhxx/Hermes_offline_v2 --skill domain-intel-ldzhhxx
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/ldzhhxx/Hermes_offline_v2/tree/main/hermes-agent/optional-skills/research/domain-intel
Command: npx skills add https://github.com/ldzhhxx/Hermes_offline_v2 --skill domain-intel-ldzhhxx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill offers a comprehensive toolset for passive domain reconnaissance, providing insights without the need for API keys or external dependencies.

Core Features & Use Cases

  • Subdomain Discovery: Identifies subdomains from certificate transparency logs.
  • SSL Certificate Inspection: Inspects TLS certificate details, including expiry, cipher, and SANs.
  • WHOIS Lookup: Extracts registration information, registrar, and dates.
  • DNS Records: Resolves A, AAAA, MX, NS, TXT, CNAME records.
  • Domain Availability Check: Assesses domain registration status passively.
  • Bulk Analysis: Runs multiple checks on multiple domains in parallel.
  • Use Case: Use this Skill to investigate a domain's infrastructure for security audits or due diligence.

Quick Start

Use the domain-intel skill to discover subdomains of example.com.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without API keys?

Passive domain reconnaissance without API keys is achieved by using Python stdlib to resolve DNS records, inspect SSL certificates, query WHOIS data, and discover subdomains from certificate transparency logs. This approach requires no external dependencies or authentication.

Can I discover subdomains from certificate transparency logs using Python?

Subdomain discovery from certificate transparency logs is supported natively. The Skill queries these logs to identify subdomains associated with a target domain, providing infrastructure insights without active scanning or external API dependencies.

How do I check SSL certificate details and expiry for a domain?

SSL certificate inspection checks TLS certificate details including expiry dates, cipher suites, and Subject Alternative Names (SANs). It uses Python stdlib to connect and extract certificate information for security audits.

What's the best way to resolve multiple DNS record types for infrastructure investigation?

Resolving multiple DNS record types for infrastructure investigation is handled by resolving A, AAAA, MX, NS, TXT, and CNAME records. It supports bulk analysis, running multiple checks on multiple domains in parallel.

Does this domain reconnaissance approach work for bulk availability checks?

Domain availability checks are supported for bulk analysis. It assesses domain registration status passively and runs multiple checks on multiple domains in parallel, making it suitable for large-scale infrastructure investigation.

Why use Python stdlib for WHOIS lookup and domain ownership verification?

Python stdlib is used for WHOIS lookup and domain ownership verification to eliminate external dependencies. It extracts registration information, registrar details, and dates without requiring API keys, ensuring a self-contained security audit.