skills.rest
Plaidmustache
PlaidmustacheCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Collect subdomains, SSL details, WHOIS data, and DNS records as structured JSON.

Updated May 4, 2026
Search Tags:#dns#ssl#osint#whois#bulk-analysis#domain-intel
One-click install
npx skills add https://github.com/Plaidmustache/hermes-nulab --skill domain-intel-plaidmustache
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/Plaidmustache/hermes-nulab/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/Plaidmustache/hermes-nulab --skill domain-intel-plaidmustache

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance using Python stdlib to perform OSINT without API keys or dependencies, enabling rapid collection of subdomains, SSL information, WHOIS data, and DNS records.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs (crt.sh) with JSON output.
  • SSL certificate inspection (expiry, issuer, SANs, and subject) and host health signals.
  • WHOIS lookups across many TLDs with parsed registrar, creation/expiration dates, and name servers.
  • DNS resolution (A/AAAA/MX/NS/TXT/CNAME) using system DNS and DoH for firewall-friendly lookups.
  • Bulk analysis across multiple domains with concurrent tasks for efficiency.

Quick Start

Run the domain_intel.py CLI against a domain to gather passive intelligence using only stdlib tools.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I gather passive OSINT data like subdomains and DNS records without API keys?▼

You can gather passive OSINT data without API keys by using Python stdlib modules to query Certificate Transparency logs, WHOIS servers, and DNS over HTTPS. This approach outputs structured JSON containing subdomains, SSL details, and DNS records for seamless integration.

Can I perform bulk domain analysis and WHOIS lookups concurrently?▼

Yes, you can perform bulk domain analysis across multiple domains using concurrent tasks. This allows for efficient concurrent WHOIS lookups, subdomain discovery, and DNS resolution, outputting structured JSON results for large-scale infrastructure audits.

What is the best way to monitor SSL certificate expiry and inspect SANs?▼

The best way to monitor SSL certificate expiry and inspect SANs is to perform passive SSL certificate inspection using Python stdlib. This retrieves the certificate's subject, issuer, expiry dates, and Subject Alternative Names, outputting the details as structured JSON.

Does passive DNS resolution work behind firewalls that block standard DNS traffic?▼

Passive DNS resolution works behind firewalls by utilizing DNS over HTTPS in addition to standard system DNS. This firewall-friendly lookup method resolves A, AAAA, MX, NS, TXT, and CNAME records using only built-in Python libraries.

Do I need to install external Python packages to run WHOIS and subdomain discovery?▼

No, you do not need to install external Python packages to run WHOIS and subdomain discovery. The tool operates entirely on Python stdlib modules, performing Certificate Transparency log queries and multi-TLD WHOIS lookups with zero dependencies.

What are the limitations of using Certificate Transparency logs for subdomain discovery?▼

A limitation of using Certificate Transparency logs for subdomain discovery is that it only surfaces subdomains that have been issued SSL certificates. Internal subdomains or those without certificates will not appear in the structured JSON output from this passive reconnaissance method.

Related Skills

Explore More Data & Analytics Skills→
Steffen025Steffen025
186

Recon

Automate passive and authorized active infrastructure reconnaissance across domains, IPs, netblocks, and ASNs.

Community
Advanced
HarriesHarries

domain-intel

Gather subdomains, SSL data, WHOIS, DNS, and availability using Python standard library.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
Quill-AgentQuill-Agent
3

domain-intel

Perform passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS, DNS records, and availability checks.

Community
Advanced