OSINT
Pull DNSDumpster hosts for a root domain
Passive DNSDumpster host lookup by domain.
overview
What dnsdumpster-host-search does
Give it a root domain; it returns the hostnames DNSDumpster already holds for that domain, each with a resolved IP. Coverage stops at what DNSDumpster has indexed.
Reach for it at the start of recon when you need a quiet seed list before any active resolve or probe. Pair with other passive sources when breadth matters more than a single dataset.
Wire the file or folder of host records into httpx for live hosts, or into dnsx to re-resolve and enrich. Managed as a Trickest provider node with one domain input.
use cases
Where dnsdumpster-host-search fits
Find hosts for a domain quietly
Search DNSDumpster for hostnames tied to a root domain to build a candidate list without querying the target's own infrastructure.
Map hostnames to IPs for pivoting
Use the hostname,IP pairs it returns to spot shared addresses, netblocks, and hosting patterns worth pivoting on before any active scan.
Seed subdomain and host workflows
Use the returned hosts as the starting set that probing, resolution, and screenshotting stages expand from.
Cross-check passive sources
Combine DNSDumpster results with other passive finders so coverage does not depend on a single data source.
reference
dnsdumpster-host-search inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Root domain to search DNSDumpster for. Passed positionally; the node exposes no other flags. |
Showing key inputs. dnsdumpster-host-search exposes 1 inputs in total.
example
Run dnsdumpster-host-search
# passive host lookup for a domain via DNSDumpsterdnsdumpster-host-search example.comwww.example.com,203.0.113.10mail.example.com,203.0.113.11blog.example.com,203.0.113.24api.example.com,198.51.100.20dev.example.com,198.51.100.21vpn.example.com,198.51.100.35autodiscover.example.com,203.0.113.11ns1.example.com,203.0.113.53guidance
Choosing dnsdumpster-host-search
Use when you have a domain and want a passive first host list with no traffic to the target. For the same service DNS record dump, use dnsdumpster-dns-lookup. For multi-source passive subs, prefer subfinder. Follow with dnsx or shuffledns when you need active resolution.
dnsdumpster-dns-lookup
Same service, DNS records instead of host rows. Use this node when you want hostname,IP pairs.
subfinder
Many passive subdomain sources. This node is a single-source DNSDumpster lookup.
dnsx
Active resolve and enrich. Run after this passive search, not instead of it.
faq
dnsdumpster-host-search questions
related
More OSINT tools
dnsdumpster-dns-lookup
Passive DNS records from DNSDumpster.
dnstwist
Generate lookalike domains and flag registered typosquats.
favup
Look up the real IP of a host from its favicon via Shodan.
Infoga
Email OSINT from public sources, with optional breach checks.
maigret
Username search that collects accounts and profile data into one dossier.
socialscan
Check whether emails and usernames are available, taken, or invalid.
Run dnsdumpster-host-search yourself
A domain feeds DNSDumpster Host Search, which returns associated hosts passively and passes them to httpx so only live hosts land as output.
Facts on this page come from the live Trickest tool library.