skills.rest
zli5460
zli5460COMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Perform passive OSINT domain analysis using DNS, WHOIS, SSL, and certificate transparency logs.

2|1|Updated May 10, 2026
Search Tags:#reconnaissance#DNS#domain#SSL#whois#passive
One-click install
npx skills add https://github.com/zli5460/hermes-agent-X-Phoenix-Architecture --skill domain-intel-zli5460
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/zli5460/hermes-agent-X-Phoenix-Architecture/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/zli5460/hermes-agent-X-Phoenix-Architecture --skill domain-intel-zli5460

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill simplifies the process of passive domain reconnaissance through Python stdlib, enabling users to discover subdomains, inspect SSL certificates, perform WHOIS lookups, and check DNS records without external APIs.

Core Features & Use Cases

  • Subdomain Discovery: Find subdomains via Certificate Transparency logs for security audits and domain profiling.
  • SSL Certificate Inspection: Check certificate expiry, issuer info, and SANs to assess domain security.
  • WHOIS Lookups: Retrieve registration details, registrar info, and domain status for domain ownership verification.
  • DNS Records Analysis: Obtain A, AAAA, MX, NS, TXT, and CNAME records to troubleshoot or audit domain configurations.
  • Domain Availability: Passively check if a domain is likely available or registered, useful for domain acquisition research.

Quick Start

Use the domain-intel skill to find subdomains of example.com or check the SSL certificate details of your target domain.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive DNS and WHOIS lookups without external API keys?▼

You can perform passive DNS and WHOIS lookups without API keys by using Python standard library tools that query DNS records and retrieve registration details directly from public WHOIS servers.

What is the best way to find subdomains using certificate transparency logs?▼

Finding subdomains using certificate transparency logs involves querying public CT log APIs to passively discover subdomains without actively scanning the target domain.

Can I check SSL certificate details and expiry dates using Python stdlib?▼

Yes, you can check SSL certificate details and expiry dates using Python stdlib by establishing a standard TLS connection to retrieve issuer info, validity periods, and SANs.

Do I need to install external dependencies to retrieve DNS TXT and MX records?▼

No, you do not need external dependencies to retrieve DNS TXT and MX records; the task is achievable using built-in Python standard library modules for passive domain analysis.

How do I passively check if a domain is available or already registered?▼

You can passively check if a domain is available or registered by querying WHOIS data and DNS records to determine registration status and resolve domain ownership without active probing.

Related Skills

Explore More Content & Communication Skills→
zangjeicyzangjeicy

domain-intel

Perform passive domain reconnaissance and DNS record resolution using Python standard libraries.

Community
Intermediate
ragnarokhaaragnarokhaa
4

domain-intel

Identify subdomains, SSL details, WHOIS data, and DNS records using Python stdlib.

Community
Intermediate
BishopCodesBishopCodes
1

Recon

Enumerate subdomains, DNS records, mail servers, and open ports.

Community
Advanced
afel6afel6

domain-intel

Identify subdomains, SSL details, WHOIS data, DNS records, and domain availability via passive OSINT.

Community
Advanced