domain-intel

Perform passive domain reconnaissance using Python stdlib.

Updated Aug 27, 2026

Search Tags:#domain reconnaissance #DNS records #domain availability #WHOIS lookup #SSL certificate #passive OSINT

Ready to run

npx skills add https://github.com/valentinuuiuiu/vikarma --skill domain-intel-valentinuuiuiu

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/valentinuuiuiu/vikarma/tree/main/hermes_agent/optional-skills/research/domain-intel
Command: npx skills add https://github.com/valentinuuiuiu/vikarma --skill domain-intel-valentinuuiuiu

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill addresses the need for passive domain reconnaissance by providing information about subdomains, SSL certificates, WHOIS data, DNS records, and domain availability without the need for API keys.

Core Features & Use Cases

Subdomain Discovery: Identifies subdomains using Certificate Transparency logs.
SSL Certificate Inspection: Examines TLS certificate details like expiry, cipher, and SANs.
WHOIS Lookup: Retrieves registration information from WHOIS servers.
DNS Records: Resolves DNS records such as A, AAAA, MX, NS, TXT, and CNAME.
Domain Availability Check: Determines if a domain is registered based on DNS, WHOIS, and SSL signals.
Use Case: For cybersecurity professionals and domain researchers looking to gather intelligence on potential targets or perform due diligence on domain registrations.

Quick Start

Analyze a domain's information using the 'domain-intel' skill.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform passive domain reconnaissance without API keys?▼

Passive domain reconnaissance is performed using Python stdlib to identify subdomains, inspect SSL certificates, lookup WHOIS data, resolve DNS records, and check domain availability. No API keys are required.

Can I discover subdomains using Certificate Transparency logs in Python?▼

Yes, subdomain discovery is achieved by querying Certificate Transparency logs. This identifies subdomains passively without needing API keys or active scanning tools.

How do I check domain availability using DNS, WHOIS, and SSL signals?▼

Domain availability is determined by cross-referencing DNS resolution, WHOIS registration data, and SSL certificate presence. This multi-signal approach verifies if a domain is currently registered.

What DNS records can I resolve using only the Python standard library?▼

You can resolve A, AAAA, MX, NS, TXT, and CNAME DNS records. The Skill handles these lookups natively without requiring third-party DNS libraries or external API dependencies.

Does this Python stdlib approach work for cybersecurity due diligence workflows?▼

Yes, it is designed for cybersecurity professionals and domain researchers performing due diligence. It gathers intelligence on targets passively using built-in Python libraries.

What SSL certificate details can I inspect with a passive OSINT script?▼

You can inspect TLS certificate details including expiry dates, cipher information, and Subject Alternative Names (SANs). This is done passively without establishing active exploit connections.