skills.rest
ruiyangruiyi
ruiyangruiyiCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Collect subdomains, DNS records, TLS properties, and WHOIS signals via JSON output.

Updated May 26, 2026
Search Tags:#subdomain discovery#domain availability#whois#dns records#tls certificate#passive osint#domain intelligence
One-click install
npx skills add https://github.com/ruiyangruiyi/hermes-agent --skill domain-intel-ruiyangruiyi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/ruiyangruiyi/hermes-agent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/ruiyangruiyi/hermes-agent --skill domain-intel-ruiyangruiyi

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps you quickly gather passive reconnaissance details about a domain—such as subdomains, DNS records, TLS certificate properties, and basic availability signals—without manual research or paid APIs.

Core Features & Use Cases

  • Passive subdomain reconnaissance: Retrieves subdomains observed in Certificate Transparency data and returns issuer and certificate expiry metadata.
  • TLS certificate inspection: Connects to the target on port 443 to extract SANs, issuer/subject fields, protocol/cipher, and expiry status.
  • WHOIS + DNS intelligence: Performs WHOIS lookups and DNS resolution (including Google DoH for common record types) to support domain profiling and checks.
  • Bulk analysis: Runs multiple checks across multiple domains in parallel and returns structured JSON output.

Quick Start

Ask the agent to run domain-intel for the target example.com and return subdomains, DNS records, and TLS expiry details in JSON.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I gather subdomains and DNS records for a domain using OSINT techniques?▼

Passive domain reconnaissance collects subdomains, DNS records, and TLS certificate properties by querying Certificate Transparency logs via crt.sh and public resolvers like Google DoH without active scanning.

How do I check TLS certificate expiry and SANs from the command line?▼

Validate TLS certificates by establishing a TCP connection to port 443 on the target domain, which extracts Subject Alternative Names, issuer fields, protocol details, and certificate expiry status.

Can I retrieve WHOIS registration data without installing external dependencies?▼

Yes, you can retrieve WHOIS registration signals by querying the target domain over TCP port 43 using only Python standard library networking modules, avoiding paid APIs or external packages.

What is the best way to perform bulk domain intelligence checks across multiple targets?▼

The best way to run bulk domain intelligence checks is executing multiple DNS, WHOIS, and TLS queries in parallel, returning all subdomains and certificate metadata as structured JSON output.

Does passive subdomain discovery work without active network scanning?▼

Yes, passive subdomain discovery works by querying Certificate Transparency logs and Google DoH endpoints over HTTPS, gathering observed subdomains without sending direct probe packets to target infrastructure.

Related Skills

Explore More Education & Research Skills→
JuanMS20JuanMS20

domain-intel

Identify domain intelligence using only Python standard library.

Community
Advanced
hypnguyen1209hypnguyen1209
338

active-directory-attack

Enumerate Active Directory components and map attack paths with BloodHound.

Community
Advanced
RooseveltAdvisorsRooseveltAdvisors
1

Recon

Automate network reconnaissance for domains, IPs, and netblocks.

Community
Advanced
SignmanalSignmanal
1

domain-intel

Collect subdomains, SSL certificates, WHOIS, and DNS records as JSON.

Community
Intermediate