domain-intel

Perform passive domain reconnaissance and DNS record resolution using Python standard libraries.

Updated Jul 13, 2026
One-click install
npx skills add https://github.com/zangjeicy/Hermes --skill domain-intel-zangjeicy
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/zangjeicy/Hermes/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/zangjeicy/Hermes --skill domain-intel-zangjeicy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This skill solves the challenge of gathering infrastructure intelligence about domains without triggering active security alerts or requiring expensive API keys.

Core Features & Use Cases

  • Passive Reconnaissance: Perform subdomain discovery, SSL inspection, WHOIS lookups, and DNS record analysis using only Python standard libraries.
  • Bulk Analysis: Efficiently process multiple domains in parallel to audit infrastructure or check domain availability.
  • Use Case: Use this tool to quickly verify the security posture of a domain by checking its SSL certificate expiry, identifying registered name servers, and discovering associated subdomains.

Quick Start

Use the domain-intel skill to perform a full DNS and SSL check on example.com.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without external APIs?

Passive domain reconnaissance can be performed using Python standard libraries to resolve DNS records, inspect SSL certificates, and query WHOIS data without external APIs. This approach ensures stealthy data collection and avoids active port scanning.

What is passive OSINT for domain infrastructure intelligence?

Passive OSINT gathers infrastructure intelligence like subdomain discovery and DNS records without triggering security alerts. It queries public records and certificates to audit domain security posture and check availability while remaining stealthy.

Can I check SSL certificate expiry and WHOIS data for multiple domains in bulk?

You can process multiple domains in parallel for bulk analysis to check SSL certificate expiry and WHOIS data. This method audits infrastructure and verifies domain availability efficiently using Python standard library functions.

Does domain reconnaissance require active port scanning to discover subdomains?

Subdomain discovery and DNS record analysis do not require active port scanning. The reconnaissance operates entirely on passive data collection methods to ensure stealthy infrastructure checks without triggering target security alerts.

When should I avoid active port scanning for security auditing?

You should avoid active port scanning when stealthy data collection is required to prevent triggering security alerts. Passive DNS resolution and SSL inspection provide sufficient infrastructure intelligence for domain auditing without active probing.