How does the -f flag and Python slice notation work?

The -f flag selects domain levels using Python slice notation. -f 3 keeps only three-label names, -f 2: keeps level 2 and everything deeper, and -f 2:4 keeps a range. Levels count labels from the TLD up, so higher numbers are deeper subdomains.

What does the -top option do?

-top X keeps only the X most frequent parent domains at the level you chose and returns all of their subdomains. It collapses a sprawling discovery list to the hosts that appear most.

Does dsieve deduplicate the list?

dsieve deduplicates the domains it emits, but it is not a general wordlist deduplicator. To remove duplicate lines from a large wordlist without reordering it, use duplicut; to append only new findings to a running file, use anew.

How do I keep a specific subdomain level instead of the root?

Set -f to that level. -f 4 returns four-label names like sub.two.example.com and drops shallower entries, so you can scope a probe to exactly the subdomain depth you care about.

Where does dsieve sit versus httpx?

Run dsieve first to normalize and scope hosts by level, then hand the shaped list to httpx or another prober. dsieve does not check liveness.

Updated Jul 15, 2026

Utilities

Shape URL lists into level-scoped host sets

Filter or extract domains from URLs by subdomain level.

Reduce a URL list to root domains Extract one subdomain level Focus on the busiest parent domains

overview

What dsieve does

Place dsieve between enumeration and probing when a URL or domain list must be normalized by subdomain level before httpx or similar.

Select depths with -f using Python slice notation, or collapse noise with -top so only the busiest parents and their children remain.

Trickest runs dsieve as a managed Utilities node: -i or -if in, folder and file out. Use duplicut for unordered wordlist dedupe and anew for append-only merges; neither replaces level-aware shaping.

source github.com/popovicn/dsieve

use cases

Where dsieve fits

Reduce a URL list to root domains

Filter a messy list of URLs to their level-2 apex domains with -f 2, giving the next stage a clean, deduplicated set of targets to work from.

Extract one subdomain level

Use -f with Python slice notation to pull out exactly the level you need, scoping a probe to second-level, third-level, or a whole range of names.

Focus on the busiest parent domains

Keep only the top X parents at a level with -top and return their children, cutting a sprawling enumeration output down to the hosts that matter most.

Normalize hosts between recon stages

Slot dsieve between discovery and probing so httpx and downstream scanners run against a scoped, level-consistent host set instead of raw URLs.

reference

dsieve inputs and flags

4 inputs

Name	Type	Flag	Description
input	STRING	-i	Input URL or domain.
input-file	FILE	-if	Input file path, one URL or domain per line.
filter-level	STRING	-f	Filter domain level. Use Python slice notation to select a range.
top	STRING	-top	Only consider the top X subdomains of a certain level and return all their subdomains.

Showing key inputs. dsieve exposes 4 inputs in total.

example

Run dsieve

dsieve · command

# extract level-3 subdomains from a URL listdsieve -if urls.txt -f 3

sample output

api.example.comapp.example.comblog.example.comcdn.example.comdev.example.commail.example.comshop.example.comvpn.example.com

guidance

Choosing dsieve

Use dsieve to normalize and scope a domain list by level between discovery and probing. Reach for duplicut to deduplicate a wordlist while keeping order. Use anew to merge new findings into a running set. dsieve is the level-aware shaping step, not a deduplicator.

duplicut

Removes duplicates from a wordlist without sorting it. dsieve filters and extracts domains by subdomain level, a different shaping job.

anew

Appends only new lines to a file. A sibling utility for keeping a running set, not for level filtering.

faq

dsieve questions

Filter to level 2 with dsieve -if urls.txt -f 2. dsieve counts labels, so level 2 is the two-label apex like example.com and higher levels add subdomains. The output is the deduplicated set of root domains.

Run dsieve yourself

A URL list feeds dsieve, which filters the domains down to the level you want and passes the scoped hosts to httpx so only live names land as output.

Run dsieve in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

input

STRING

-i

Input URL or domain.

input-file

FILE

-if

Input file path, one URL or domain per line.

filter-level

STRING

-f

Filter domain level. Use Python slice notation to select a range.

top

STRING

-top

Only consider the top X subdomains of a certain level and return all their subdomains.

Shape URL lists into level-scoped host sets

What dsieve does

Where dsieve fits

Reduce a URL list to root domains

Extract one subdomain level

Focus on the busiest parent domains

Normalize hosts between recon stages

dsieve inputs and flags

Run dsieve

Choosing dsieve

duplicut

anew

dsieve questions

More Utilities tools

cewl

dnsgen

airtable-integration

apktool-decode

assert-tool

aws-route53-zones

Run dsieve yourself

Shape URL lists into level-scoped host sets

What dsieve does

Where dsieve fits

Reduce a URL list to root domains

Extract one subdomain level

Focus on the busiest parent domains

Normalize hosts between recon stages

dsieve inputs and flags

Run dsieve

Choosing dsieve

duplicut

anew

dsieve questions

More Utilities tools

cewl

dnsgen

airtable-integration

apktool-decode

assert-tool

aws-route53-zones

Run dsieve yourself