Domain Intelligence: Passive OSINT with Python Stdlib
Passive recon of subdomains, SSL certs, WHOIS, and DNS.
Written by Neura Market from the official Hermes Agent documentation for Domain Intel. Commands, paths, and version numbers are reproduced from the source unchanged.
Read the official documentationDomain Intelligence is a passive reconnaissance skill for Hermes Agent that answers infrastructure questions about a domain: what subdomains exist, when the SSL certificate expires, who registered it, and what DNS records it publishes. You would reach for this when you need technical facts about a domain's setup, not general information about the company behind it. It is a zero-dependency, zero-API-key tool that runs on Linux, macOS, and Windows, making it a reliable first stop for OSINT-style investigations.
What it does
This skill ships a single Python script, scripts/domain_intel.py, that acts as a command-line interface for five distinct checks plus a bulk mode. Each check pulls from a different passive data source: Certificate Transparency logs for subdomains, direct TLS inspection for certificates, WHOIS servers for registration details, and a mix of system DNS and Google DNS-over-HTTPS for record lookups. The availability check combines three passive signals to guess whether a domain is registered. All output is structured JSON, which makes it easy to pipe into other tools or parse programmatically.
The script is designed to be run from the command line, either directly by a user or by the Hermes agent through its terminal skill. Because it uses only the Python standard library, there is no installation step beyond having Python available. The skill is marked as optional and installed on demand, so it is not part of the default Hermes Agent setup.
Before you start
- Skill installation: This is an optional skill. Install it on demand using the Hermes Agent skill management commands. The skill path is
optional-skills/research/domain-intel. - Python: The script requires Python 3 with the standard library modules
socket,ssl,urllib,json, andconcurrent.futures. No third-party packages are needed. - Network access: The script makes outbound connections to several services. Most checks use HTTPS (port 443), which works behind most firewalls. WHOIS queries use TCP port 43, which may be blocked on restrictive networks. DNS lookups for MX, NS, TXT, and CNAME records use Google DNS-over-HTTPS, which is firewall-friendly. The SSL check connects directly to the target on port 443.
- Platform: The skill works identically on Linux, macOS, and Windows.
Helper script
The skill includes scripts/domain_intel.py, a complete CLI tool for all domain intelligence operations. Replace SKILL_DIR with the directory containing this SKILL.md file.
# Subdomain discovery via Certificate Transparency logs
python SKILL_DIR/scripts/domain_intel.py subdomains example.com
# SSL certificate inspection (expiry, cipher, SANs, issuer)
python SKILL_DIR/scripts/domain_intel.py ssl example.com
# WHOIS lookup (registrar, dates, name servers — 100+ TLDs)
python SKILL_DIR/scripts/domain_intel.py whois example.com
# DNS records (A, AAAA, MX, NS, TXT, CNAME)
python SKILL_DIR/scripts/domain_intel.py dns example.com
# Domain availability check (passive: DNS + WHOIS + SSL signals)
python SKILL_DIR/scripts/domain_intel.py available coolstartup.io
# Bulk analysis — multiple domains, multiple checks in parallel
python SKILL_DIR/scripts/domain_intel.py bulk example.com github.com google.com
python SKILL_DIR/scripts/domain_intel.py bulk example.com github.com --checks ssl,dns
SKILL_DIR is the directory containing this SKILL.md file. All output is structured JSON.
Available commands
The table below summarizes each command, what it does, and the data source it uses.
| Command | What it does | Data source |
|---|---|---|
subdomains | Find subdomains from certificate logs | crt.sh (HTTPS) |
ssl | Inspect TLS certificate details | Direct TCP:443 to target |
whois | Registration info, registrar, dates | WHOIS servers (TCP:43) |
dns | A, AAAA, MX, NS, TXT, CNAME records | System DNS + Google DoH |
available | Check if domain is registered | DNS + WHOIS + SSL signals |
bulk | Run multiple checks on multiple domains | All of the above |
Subdomain discovery
The subdomains command queries crt.sh, which aggregates Certificate Transparency logs. Every time a certificate is issued for a domain, the domain name appears in these logs, so this command can reveal subdomains that are not linked anywhere else. This is a purely passive technique: it only reads public certificate data over HTTPS. For popular domains with thousands of certificates, crt.sh can be slow, so set reasonable expectations when running this on high-traffic sites.
SSL certificate inspection
The ssl command connects directly to the target on port 443 and inspects the TLS certificate. It reports the expiry date, the cipher suite, the Subject Alternative Names (SANs), and the issuer. This is the only "active" operation in the skill, because it establishes a TCP connection to the target. It does not perform any vulnerability scanning or port scanning; it simply reads the certificate presented during a standard TLS handshake.
WHOIS lookup
The whois command queries WHOIS servers directly on TCP port 43. It works with over 100 TLDs by contacting the authoritative registrar for each. The output includes the registrar, registration and expiration dates, and name servers. Be aware that some WHOIS servers redact registrant information due to GDPR, so the output may not include personal details. If you are using this for a domain that falls under GDPR, mention this limitation to the user.
DNS records
The dns command resolves A and AAAA records using the system's configured DNS resolver, and fetches MX, NS, TXT, and CNAME records via Google DNS-over-HTTPS. This split approach keeps the query firewall-friendly while still providing a complete picture of the domain's DNS configuration. The output is structured JSON, so you can easily extract specific record types.
Domain availability
The available command checks whether a domain is registered by combining three passive signals: DNS resolution, WHOIS data, and SSL certificate presence. If none of these signals indicate an existing registration, the domain is likely available. This is a heuristic check, not an authoritative one. For a definitive answer, you would need to query a registrar's API, which this skill does not do.
Bulk analysis
The bulk command runs multiple checks on multiple domains in parallel. By default, it runs all checks on each domain. You can limit the checks with the --checks flag, as shown in the example above. This is useful for comparing several domains at once, such as auditing a list of potential acquisitions or monitoring a set of your own domains.
When to use this vs built-in tools
This skill is specifically for infrastructure-level questions. For general research about what a domain or company does, use web_search. To get the actual content of a webpage, use web_extract. For a simple "is this URL reachable" check, use the terminal skill with curl -I. The table below summarizes the best tool for common tasks.
| Task | Better tool | Why |
|---|---|---|
| "What does example.com do?" | web_extract | Gets page content, not DNS/WHOIS data |
| "Find info about a company" | web_search | General research, not domain-specific |
| "Is this website safe?" | web_search | Reputation checks need web context |
| "Check if a URL is reachable" | terminal with curl -I | Simple HTTP check |
| "Find subdomains of X" | This skill | Only passive source for this |
| "When does the SSL cert expire?" | This skill | Built-in tools can't inspect TLS |
| "Who registered this domain?" | This skill | WHOIS data not in web search |
| "Is coolstartup.io available?" | This skill | Passive availability via DNS+WHOIS+SSL |
Platform compatibility
Pure Python stdlib (socket, ssl, urllib, json, concurrent.futures). Works identically on Linux, macOS, and Windows with no dependencies.
- crt.sh queries use HTTPS (port 443), works behind most firewalls
- WHOIS queries use TCP port 43, may be blocked on restrictive networks
- DNS queries use Google DoH (HTTPS) for MX/NS/TXT, firewall-friendly
- SSL checks connect to the target on port 443, the only "active" operation
Data sources
All queries are passive, no port scanning, no vulnerability testing:
- crt.sh, Certificate Transparency logs (subdomain discovery, HTTPS only)
- WHOIS servers, Direct TCP to 100+ authoritative TLD registrars
- Google DNS-over-HTTPS, MX, NS, TXT, CNAME resolution (firewall-friendly)
- System DNS, A/AAAA record resolution
- SSL check is the only "active" operation (TCP connection to target:443)
Limits and gotchas
- WHOIS queries use TCP port 43, may be blocked on restrictive networks
- Some WHOIS servers redact registrant info (GDPR), mention this to the user
- crt.sh can be slow for very popular domains (thousands of certs), set reasonable expectations
- The availability check is heuristic-based (3 passive signals), not authoritative like a registrar API
What pairs with this
This skill is part of the Research category in Hermes Agent. It complements web_search for general company research and web_extract for pulling page content. For a broader OSINT workflow, you might combine this skill with other research skills that ship with the agent, such as those for social media or news monitoring. The skill was contributed by @FurkanL0, and you can find more details in the official Hermes Agent documentation.