loading
Loading content
loading
OSINT
Passive DNSDumpster host lookup by domain.
overview
Give it a root domain; it returns the hostnames DNSDumpster already holds for that domain, each with a resolved IP. Coverage stops at what DNSDumpster has indexed.
Reach for it at the start of recon when you need a quiet seed list before any active resolve or probe. Pair with other passive sources when breadth matters more than a single dataset.
Wire the file or folder of host records into httpx for live hosts, or into dnsx to re-resolve and enrich. Managed as a Trickest provider node with one domain input.
use cases
Search DNSDumpster for hostnames tied to a root domain to build a candidate list without querying the target's own infrastructure.
Use the hostname,IP pairs it returns to spot shared addresses, netblocks, and hosting patterns worth pivoting on before any active scan.
Use the returned hosts as the starting set that probing, resolution, and screenshotting stages expand from.
Combine DNSDumpster results with other passive finders so coverage does not depend on a single data source.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Root domain to search DNSDumpster for. Passed positionally; the node exposes no other flags. |
Showing key inputs. dnsdumpster-host-search exposes 1 inputs in total.
example
# passive host lookup for a domain via DNSDumpsterdnsdumpster-host-search example.comwww.example.com,203.0.113.10mail.example.com,203.0.113.11blog.example.com,203.0.113.24api.example.com,198.51.100.20dev.example.com,198.51.100.21vpn.example.com,198.51.100.35autodiscover.example.com,203.0.113.11ns1.example.com,203.0.113.53guidance
Use when you have a domain and want a passive first host list with no traffic to the target. For the same service DNS record dump, use dnsdumpster-dns-lookup. For multi-source passive subs, prefer subfinder. Follow with dnsx or shuffledns when you need active resolution.
Same service, DNS records instead of host rows. Use this node when you want hostname,IP pairs.
Many passive subdomain sources. This node is a single-source DNSDumpster lookup.
Active resolve and enrich. Run after this passive search, not instead of it.
faq
related
Passive DNS records from DNSDumpster.
Generate lookalike domains and flag registered typosquats.
Look up the real IP of a host from its favicon via Shodan.
Email OSINT from public sources, with optional breach checks.
Check whether emails and usernames are available, taken, or invalid.
List public repositories for each GitHub username you already have.
A domain feeds DNSDumpster Host Search, which returns associated hosts passively and passes them to httpx so only live hosts land as output.
Facts on this page come from the live Trickest tool library.