skills.rest
matthew-johnson
matthew-johnsonCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Identify passive domain intelligence data using Python standard library without external APIs.

Updated Apr 20, 2026
Search Tags:#dns#ssl#osint#whois#subdomains#domain-intel
One-click install
npx skills add https://github.com/matthew-johnson/hermes-agent --skill domain-intel-matthew-johnson
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/matthew-johnson/hermes-agent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/matthew-johnson/hermes-agent --skill domain-intel-matthew-johnson

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance using only Python stdlib, with zero dependencies.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs
  • TLS/SSL certificate inspection, including issuer, expiry, and SANs
  • WHOIS lookups and basic domain metadata
  • DNS record resolution (A/AAAA/MX/NS/TXT/CNAME)
  • Bulk analysis across multiple domains with JSON output
  • No API keys required; runs locally with standard library

Quick Start

Run the domain_intel tool against a domain to collect subdomains, SSL details, WHOIS info, DNS records, and availability signals.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains and SSL certificate details without using external APIs?▼

Subdomain discovery and SSL certificate inspection can be performed locally using Python stdlib. This approach queries Certificate Transparency logs via CRT.sh and parses TLS certificates to extract issuer, expiry, and SANs without requiring external API keys.

Can I resolve DNS records for multiple domains in bulk and export the results?▼

Yes, DNS record resolution for A, AAAA, MX, NS, TXT, and CNAME records can be run across multiple domains simultaneously. The bulk analysis workflow generates JSON output containing all collected domain intelligence data for easy export.

Do I need to install any Python packages or dependencies for WHOIS lookups?▼

No, WHOIS lookups and basic domain metadata retrieval require zero external dependencies. The tool runs entirely using the Python standard library, meaning no pip installations or package management is necessary before executing domain intelligence tasks.

What is passive domain intelligence and how does DNS over HTTPS fit in?▼

Passive domain intelligence gathers data without actively scanning or sending direct probes to the target infrastructure. DNS resolution is handled via DNS over HTTPS (DoH) to securely retrieve records while maintaining a non-intrusive reconnaissance posture.

What's the best way to check domain availability and gather OSINT data locally?▼

Using a Python stdlib-based tool that aggregates WHOIS data, DNS records, and Certificate Transparency logs provides a reliable local OSINT method. It checks domain availability signals while compiling comprehensive metadata without external services or paid APIs.

Related Skills

Explore More Data & Analytics Skills→
zerwizzerwiz

domain-intel

Your AI-powered command and data center for domain intelligence, delivering instant situational awareness and automated reporting to accelerate your next move.

Community
Intermediate
ever-oliever-oli
3

domain-intel

Collect passive domain intelligence via subdomains, SSL, WHOIS, DNS, and availability.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
AeonDaveAeonDave
15

amass

Enumerate subdomains and map attack surfaces for a domain.

Community
Advanced