Domain Intelligence — Passive OSINT
Passive domain reconnaissance using only Python stdlib.
Zero dependencies. Zero API keys. Works on Linux, macOS, and Windows.
Helper script
This skill includes scripts/domain_intel.py — a complete CLI tool for all domain intelligence operations.
# Subdomain discovery via Certificate Transparency logs
python3 SKILL_DIR/scripts/domain_intel.py subdomains example.com
# SSL certificate inspection (expiry, cipher, SANs, issuer)
python3 SKILL_DIR/scripts/domain_intel.py ssl example.com
# WHOIS lookup (registrar, dates, name servers — 100+ TLDs)
python3 SKILL_DIR/scripts/domain_intel.py whois example.com
# DNS records (A, AAAA, MX, NS, TXT, CNAME)
python3 SKILL_DIR/scripts/domain_intel.py dns example.com
# Domain availability check (passive: DNS + WHOIS + SSL signals)
python3 SKILL_DIR/scripts/domain_intel.py available coolstartup.io
# Bulk analysis — multiple domains, multiple checks in parallel
python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com google.com
python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com --checks ssl,dns
SKILL_DIR is the directory containing this SKILL.md file. All output is structured JSON.
Available commands
| Command |
What it does |
Data source |
subdomains |
Find subdomains from certificate logs |
crt.sh (HTTPS) |
ssl |
Inspect TLS certificate details |
Direct TCP:443 to target |
whois |
Registration info, registrar, dates |
WHOIS servers (TCP:43) |
dns |
A, AAAA, MX, NS, TXT, CNAME records |
System DNS + Google DoH |
available |
Check if domain is registered |
DNS + WHOIS + SSL signals |
bulk |
Run multiple checks on multiple domains |
All of the above |
When to use this vs built-in tools
- Use this skill for infrastructure questions: subdomains, SSL certs, WHOIS, DNS records, availability
- Use
web_search for general research about what a domain/company does
- Use
web_extract to get the actual content of a webpage
- Use
terminal with curl -I for a simple "is this URL reachable" check
| Task |
Better tool |
Why |
| "What does example.com do?" |
web_extract |
Gets page content, not DNS/WHOIS data |
| "Find info about a company" |
web_search |
General research, not domain-specific |
| "Is this website safe?" |
web_search |
Reputation checks need web context |
| "Check if a URL is reachable" |
terminal with curl -I |
Simple HTTP check |
| "Find subdomains of X" |
This skill |
Only passive source for this |
| "When does the SSL cert expire?" |
This skill |
Built-in tools can't inspect TLS |
| "Who registered this domain?" |
This skill |
WHOIS data not in web search |
| "Is coolstartup.io available?" |
This skill |
Passive availability via DNS+WHOIS+SSL |
Platform compatibility
Pure Python stdlib (socket, ssl, urllib, json, concurrent.futures).
Works identically on Linux, macOS, and Windows with no dependencies.
- crt.sh queries use HTTPS (port 443) — works behind most firewalls
- WHOIS queries use TCP port 43 — may be blocked on restrictive networks
- DNS queries use Google DoH (HTTPS) for MX/NS/TXT — firewall-friendly
- SSL checks connect to the target on port 443 — the only "active" operation
Data sources
All queries are passive — no port scanning, no vulnerability testing:
- crt.sh — Certificate Transparency logs (subdomain discovery, HTTPS only)
- WHOIS servers — Direct TCP to 100+ authoritative TLD registrars
- Google DNS-over-HTTPS — MX, NS, TXT, CNAME resolution (firewall-friendly)
- System DNS — A/AAAA record resolution
- SSL check is the only "active" operation (TCP connection to target:443)
Notes
- WHOIS queries use TCP port 43 — may be blocked on restrictive networks
- Some WHOIS servers redact registrant info (GDPR) — mention this to the user
- crt.sh can be slow for very popular domains (thousands of certs) — set reasonable expectations
- The availability check is heuristic-based (3 passive signals) — not authoritative like a registrar API
Contributed by @FurkanL0
Source: NousResearch/hermes-agent → optional-skills/research/domain-intel/SKILL.md
1---2name: domain-intel3description: "Passive recon of subdomains, SSL certs, WHOIS, and DNS."4category: research-and-academic5source_repo: NousResearch/hermes-agent6source_path: "optional-skills/research/domain-intel/SKILL.md"7source_url: https://github.com/NousResearch/hermes-agent/blob/HEAD/optional-skills/research/domain-intel/SKILL.md8---91011# Domain Intelligence — Passive OSINT1213Passive domain reconnaissance using only Python stdlib.14**Zero dependencies. Zero API keys. Works on Linux, macOS, and Windows.**1516## Helper script1718This skill includes `scripts/domain_intel.py` — a complete CLI tool for all domain intelligence operations.1920```bash21# Subdomain discovery via Certificate Transparency logs22python3 SKILL_DIR/scripts/domain_intel.py subdomains example.com2324# SSL certificate inspection (expiry, cipher, SANs, issuer)25python3 SKILL_DIR/scripts/domain_intel.py ssl example.com2627# WHOIS lookup (registrar, dates, name servers — 100+ TLDs)28python3 SKILL_DIR/scripts/domain_intel.py whois example.com2930# DNS records (A, AAAA, MX, NS, TXT, CNAME)31python3 SKILL_DIR/scripts/domain_intel.py dns example.com3233# Domain availability check (passive: DNS + WHOIS + SSL signals)34python3 SKILL_DIR/scripts/domain_intel.py available coolstartup.io3536# Bulk analysis — multiple domains, multiple checks in parallel37python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com google.com38python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com --checks ssl,dns39```4041`SKILL_DIR` is the directory containing this SKILL.md file. All output is structured JSON.4243## Available commands4445| Command | What it does | Data source |46|---------|-------------|-------------|47| `subdomains` | Find subdomains from certificate logs | crt.sh (HTTPS) |48| `ssl` | Inspect TLS certificate details | Direct TCP:443 to target |49| `whois` | Registration info, registrar, dates | WHOIS servers (TCP:43) |50| `dns` | A, AAAA, MX, NS, TXT, CNAME records | System DNS + Google DoH |51| `available` | Check if domain is registered | DNS + WHOIS + SSL signals |52| `bulk` | Run multiple checks on multiple domains | All of the above |5354## When to use this vs built-in tools5556- **Use this skill** for infrastructure questions: subdomains, SSL certs, WHOIS, DNS records, availability57- **Use `web_search`** for general research about what a domain/company does58- **Use `web_extract`** to get the actual content of a webpage59- **Use `terminal` with `curl -I`** for a simple "is this URL reachable" check6061| Task | Better tool | Why |62|------|-------------|-----|63| "What does example.com do?" | `web_extract` | Gets page content, not DNS/WHOIS data |64| "Find info about a company" | `web_search` | General research, not domain-specific |65| "Is this website safe?" | `web_search` | Reputation checks need web context |66| "Check if a URL is reachable" | `terminal` with `curl -I` | Simple HTTP check |67| "Find subdomains of X" | **This skill** | Only passive source for this |68| "When does the SSL cert expire?" | **This skill** | Built-in tools can't inspect TLS |69| "Who registered this domain?" | **This skill** | WHOIS data not in web search |70| "Is coolstartup.io available?" | **This skill** | Passive availability via DNS+WHOIS+SSL |7172## Platform compatibility7374Pure Python stdlib (`socket`, `ssl`, `urllib`, `json`, `concurrent.futures`).75Works identically on Linux, macOS, and Windows with no dependencies.7677- **crt.sh queries** use HTTPS (port 443) — works behind most firewalls78- **WHOIS queries** use TCP port 43 — may be blocked on restrictive networks79- **DNS queries** use Google DoH (HTTPS) for MX/NS/TXT — firewall-friendly80- **SSL checks** connect to the target on port 443 — the only "active" operation8182## Data sources8384All queries are **passive** — no port scanning, no vulnerability testing:8586- **crt.sh** — Certificate Transparency logs (subdomain discovery, HTTPS only)87- **WHOIS servers** — Direct TCP to 100+ authoritative TLD registrars88- **Google DNS-over-HTTPS** — MX, NS, TXT, CNAME resolution (firewall-friendly)89- **System DNS** — A/AAAA record resolution90- **SSL check** is the only "active" operation (TCP connection to target:443)9192## Notes9394- WHOIS queries use TCP port 43 — may be blocked on restrictive networks95- Some WHOIS servers redact registrant info (GDPR) — mention this to the user96- crt.sh can be slow for very popular domains (thousands of certs) — set reasonable expectations97- The availability check is heuristic-based (3 passive signals) — not authoritative like a registrar API9899---100101*Contributed by [@FurkanL0](https://github.com/FurkanL0)*102103---104105**Source:** [`NousResearch/hermes-agent`](https://github.com/NousResearch/hermes-agent) → `optional-skills/research/domain-intel/SKILL.md`
NousResearch