domain-intel

Performs domain intelligence using only Python's standard library.

1|Updated Jan 31, 2026
One-click install
npx skills add https://github.com/Monjyu1101/AiDiy2026 --skill domain-intel-monjyu1101
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/Monjyu1101/AiDiy2026/tree/main/backend_hermes/optional-skills/research/domain-intel
Command: npx skills add https://github.com/Monjyu1101/AiDiy2026 --skill domain-intel-monjyu1101

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance using Python stdlib to discover subdomains, TLS certificate details, WHOIS data, DNS records, and domain availability signals with zero external dependencies and no API keys.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs (crt.sh)
  • SSL certificate inspection (expiry, issuer, SANs)
  • WHOIS lookup for registrar, dates, and name servers
  • DNS records resolution (A/AAAA/MX/NS/TXT/CNAME)
  • Bulk analysis across multiple domains
  • Simple CLI-driven workflows for security monitoring and domain enumeration

Quick Start

Run the included CLI script to perform a domain intelligence task, for example, discover subdomains for example.com or run bulk analysis on multiple domains.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains using Certificate Transparency logs without external dependencies?

You can find subdomains by querying Certificate Transparency logs via crt.sh. This passive subdomain discovery uses only Python's standard library, requiring no external dependencies or API keys to enumerate targets.

Can I check SSL certificate expiry and issuer details using Python stdlib?

Yes, you can check SSL certificate details including expiry dates and issuer information. The SSL certificate inspection feature operates entirely with Python's standard library to extract TLS data without external modules.

What is the best way to perform bulk WHOIS and DNS lookups across multiple domains?

The best way for bulk WHOIS and DNS lookups is using a CLI-driven bulk analysis workflow. It processes multiple domains simultaneously to retrieve registrar data, name servers, and DNS records, outputting structured JSON.

Do I need to install API keys or external packages to resolve DNS records?

No, you do not need API keys or external packages to resolve DNS records. The tool resolves A, AAAA, MX, NS, TXT, and CNAME records using exclusively built-in Python standard library modules.

Does passive domain reconnaissance work for brand discovery and infrastructure monitoring?

Yes, passive domain reconnaissance works for brand discovery and infrastructure monitoring. By aggregating WHOIS data, DNS records, and subdomains across single or multiple targets, it identifies brand assets and monitors infrastructure changes.