skills.rest
MLT-OSS
MLT-OSSOFFICIAL
Explore all skills by this author →
WebsiteGitHub

domain-intel

Performs passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS lookups, and DNS queries.

14|5|Updated Apr 9, 2026
Search Tags:#reconnaissance#dns#subdomain discovery#osint#domain availability#whois#ssl certificate
One-click install
npx skills add https://github.com/MLT-OSS/hermes-agent-go --skill domain-intel-mlt-oss
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/MLT-OSS/hermes-agent-go/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/MLT-OSS/hermes-agent-go --skill domain-intel-mlt-oss

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Gathering infrastructure intelligence about a domain normally requires multiple paid tools or API keys. This Skill performs passive domain reconnaissance using only the Python standard library, answering questions about subdomains, SSL certificates, WHOIS registration, DNS records, and domain availability without any dependencies or API keys. ## Core Features & Use Cases - Subdomain Discovery: Enumerate subdomains from Certificate Transparency logs via crt.sh, with optional filtering of expired certificates. - SSL & WHOIS Inspection: Check TLS certificate expiry, cipher suites, and SANs, plus registrar, creation, and expiration dates across 100+ TLD WHOIS servers. - DNS & Availability Checks: Resolve A, AAAA, MX, NS, TXT, and CNAME records via system DNS and Google DoH, and estimate domain availability from three passive signals. - Bulk Analysis: Run multiple checks across up to 20 domains in parallel with structured JSON output. - Use Case: Before acquiring a domain for a new project, run the availability check on several candidates, then inspect the SSL expiry and WHOIS history of a competitor's domain for research. ## Quick Start Ask the agent to find all subdomains of example.com and check when its SSL certificate expires using the domain-intel skill.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains of a domain without an API key?▼

Query Certificate Transparency logs through crt.sh, which publishes all issued TLS certificates. The subdomains command fetches these entries over HTTPS, deduplicates names, and filters out expired certificates by default.

How to check when an SSL certificate expires from the command line?▼

Connect to the host on port 443 with a TLS handshake and parse the certificate's notAfter field. The ssl command returns days remaining, expiry status, cipher suite, TLS version, and subject alternative names as JSON.

Does this WHOIS lookup work on Windows and macOS?▼

Yes, the tool uses only Python standard library modules like socket, ssl, and urllib, so it runs identically on Linux, macOS, and Windows. Note that WHOIS queries use TCP port 43, which some restrictive networks block.

Why does WHOIS sometimes show no registrant information?▼

Many WHOIS servers redact registrant details due to GDPR privacy regulations. The lookup still returns registrar, dates, and name servers when available, but personal contact fields may be omitted by the registry.

Is the domain availability check authoritative?▼

No, it is a heuristic combining three passive signals: DNS resolution, WHOIS response, and SSL reachability. It returns a confidence level with the verdict, but only a registrar API can authoritatively confirm availability.

When should I use web search instead of domain reconnaissance?▼

Use web search or content extraction to learn what a company does or whether a site has a good reputation. Use passive domain reconnaissance only for infrastructure questions like subdomains, DNS records, SSL expiry, and registration data.

Related Skills

Explore More Software Engineering Skills→
CodeAlive-AICodeAlive-AI
3

exa-company-research

Find company intelligence from Exa search with category-aware web queries.

Official
Intermediate
GregsGreyCodeGregsGreyCode
6

domain-intel

Find subdomains, SSL certificates, WHOIS, and DNS records using Python's standard library.

Community
Intermediate
K-Dense-AIK-Dense-AI
33.0k

parallel-web

Search the web, extract URLs, enrich datasets, and generate scholarly reports.

Official
Advanced
azaanalirazaazaanaliraza

domain-intel

Performs passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS lookups, and DNS queries.

Community
Intermediate