skills.rest
twjarviszyra-web
twjarviszyra-webCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Extract subdomains, DNS records, WHOIS data, and SSL certificate details from domains.

3|Updated Apr 4, 2026
Search Tags:#dns#ssl#domain#osint#whois#subdomains
One-click install
npx skills add https://github.com/twjarviszyra-web/hermes-unbound --skill domain-intel-twjarviszyra-web
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/twjarviszyra-web/hermes-unbound/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/twjarviszyra-web/hermes-unbound --skill domain-intel-twjarviszyra-web

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill removes the guesswork from domain investigations by gathering passive intelligence about a domain without relying on paid APIs or intrusive scanning.

Core Features & Use Cases

  • Subdomain Discovery: Enumerate subdomains from Certificate Transparency logs to map exposed infrastructure.
  • SSL and WHOIS Inspection: Check certificate expiry, issuers, subject names, registrars, dates, and name servers.
  • DNS and Availability Analysis: Resolve A, AAAA, MX, NS, TXT, and CNAME records, then combine passive signals to estimate whether a domain is registered or in use.
  • Bulk Research Workflows: Analyze multiple domains in parallel for audits, competitive research, incident triage, and infrastructure reconnaissance.

Quick Start

Ask the domain-intel skill to analyze example.com for subdomains, DNS records, WHOIS details, SSL certificate status, or domain availability.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains and DNS records for a domain without active scanning?▼

Passive domain intelligence gathering extracts subdomains, DNS records, and SSL certificate details using Certificate Transparency logs and DNS-over-HTTPS without intrusive scanning. This approach maps exposed infrastructure and resolves A, AAAA, MX, NS, TXT, and CNAME records securely.

Can I check SSL certificate expiry and WHOIS details for multiple domains in bulk?▼

Yes, bulk multi-domain analysis can check SSL certificate expiry, issuers, registrars, and WHOIS dates in parallel. This passive inspection method aggregates structured JSON output for audits, competitive research, and incident triage across multiple target domains.

What is the best way to check if a domain is registered or in use?▼

Combining passive signals from DNS record resolution, WHOIS lookups, and SSL certificate inspection estimates domain availability and usage. Analyzing these structured signals determines whether a domain is actively registered and in use without sending direct probe traffic.

Do I need paid APIs or external dependencies to perform WHOIS lookups and subdomain discovery?▼

No, passive domain profiling requires only the Python standard library networking. It performs WHOIS lookups over TCP port 43 and subdomain discovery via HTTPS, avoiding paid APIs and external dependencies while returning structured JSON output.

Does passive domain profiling work for infrastructure reconnaissance during incident triage?▼

Yes, passive domain profiling supports infrastructure reconnaissance and incident triage by enumerating subdomains from Certificate Transparency logs and inspecting SSL certificates. It gathers intelligence securely over HTTPS and TLS on port 443 without alerting target systems.

Related Skills

Explore More Education & Research Skills→
ernijsansonsernijsansons

freight-intelligence-master

Coordinate freight intelligence gathering and campaign orchestration for RFP opportunities.

Community
Advanced
chagongchagong
1

send-notification

Send structured JSON payloads as adaptive card notifications to Microsoft Teams via Azure Logic App.

Community
Basic
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
phatblatphatblat
12

Recon

Automate infrastructure and network reconnaissance for domains, IPs, and netblocks.

Community
Advanced