What does httprobe check?

For each domain it tests HTTP on port 80 and HTTPS on port 443, then prints the full URL of every scheme that answers. Liveness only: no status code, page title, or tech fingerprinting.

How is httprobe different from httpx?

httprobe only reports which hosts answer over HTTP or HTTPS. httpx probes the same hosts and can return status code, page title, detected tech, and TLS detail in one pass. Use httprobe as a quick filter; use httpx when you need those fields.

Can httprobe probe non-standard ports?

Yes. Pass -p with a protocol:port pair, for example -p http:8080 or -p https:8443. Combine with -s to skip the default 80 and 443 checks and test only the ports you name.

Is httprobe still maintained?

The upstream tomnomnom repository is archived, so it no longer ships new commits. The binary still builds and runs, and Trickest pins a working version as a node. For an actively developed probe with more fields, use httpx.

What should run after httprobe?

Feed the live URLs into a richer prober like httpx or a scanner like nuclei. Dead hosts are already dropped, so downstream nodes spend budget only on domains that respond.

Updated Jul 14, 2026

Network

Thin a domain list to live HTTP and HTTPS hosts

Probe a domain list for working HTTP and HTTPS servers.

Filter a subdomain list to live hosts Find HTTP and HTTPS quickly Probe non-standard ports

overview

What httprobe does

httprobe answers one question: which domains in a list have a web server answering. Feed it domains and it tests HTTP on port 80 and HTTPS on port 443, printing every scheme that responds. That tight scope makes it a clean filter between subdomain discovery and anything that needs live hosts.

Keep it minimal. Raise concurrency with -c, set a timeout with -t, prefer HTTPS with --prefer-https to skip HTTP when TLS already answers, add protocol:port probes with -p, or skip defaults with -s. No status codes, titles, or tech detection. Liveness only, then hand off.

Trickest runs httprobe as a managed Network node: domains file in, file and folder of live URLs out. Place it after subdomain discovery to drop dead hosts before a richer prober or scanner spends budget on them.

source github.com/tomnomnom/httprobe

use cases

Where httprobe fits

Filter a subdomain list to live hosts

Run httprobe over subfinder output to keep only the domains with a web server answering, cutting dead weight before scanning.

Find HTTP and HTTPS quickly

Probe port 80 and 443 across thousands of domains in one fast pass to learn which schemes each host serves.

Probe non-standard ports

Add protocol:port probes with -p to catch web services running off 80 and 443 without switching tools.

Prefer HTTPS for speed

Use --prefer-https to skip the HTTP check when TLS already responds, halving requests on a large list.

reference

httprobe inputs and flags

7 inputs

Name	Type	Flag	Description
domains	FILE	·	List of domains to probe, one per line, read from standard input.
threads	STRING	-c	Number of concurrent workers (default 20).
timeout	STRING	-t	Per-request timeout in milliseconds (default 10000).
prefer-https	BOOLEAN	--prefer-https	Skip the HTTP check when HTTPS already responds.
protocol-port	STRING	-p	Add an extra probe for a protocol:port pair beyond the defaults, e.g. http:8080.
skip-standard-ports	BOOLEAN	-s	Skip the default HTTP:80 and HTTPS:443 probes and test only the ports you name.

Showing key inputs. httprobe exposes 7 inputs in total.

Full flag reference (7 inputs)

Name	Type	Flag	Description
domains	FILE	·	List of domains to probe, one per line, read from standard input.
threads	STRING	-c	Number of concurrent workers (default 20).
timeout	STRING	-t	Per-request timeout in milliseconds (default 10000).
prefer-https	BOOLEAN	--prefer-https	Skip the HTTP check when HTTPS is already working.
protocol-port	STRING	-p	Add an extra probe for a protocol:port pair beyond the port 80 and port 443 defaults, e.g. http:8080.
protocol-port-2	STRING	-p	A second protocol:port slot for adding another non-standard port to probe.
skip-standard-ports	BOOLEAN	-s	Skip the default HTTP:80 and HTTPS:443 probes and test only the protocol:port pairs you specify.

example

Run httprobe

httprobe · command

# probe a subdomain list for live HTTP and HTTPS, 50 concurrent workers, add port 8443cat subdomains.txt | httprobe -c 50 -t 3000 -p https:8443

sample output

https://api.example.comhttp://app.example.comhttps://app.example.comhttps://staging.example.comhttp://dev.example.comhttps://mail.example.comhttps://vpn.example.comhttps://gitlab.example.com:8443

guidance

Choosing httprobe

Use httprobe when you only need to know which domains answer over HTTP or HTTPS. When you also want status, title, and tech in the same pass, use httpx instead.

httpx

Probes liveness plus status, title, tech, and TLS in one pass. More signal per request than httprobe.

subfinder

Discovers the subdomains httprobe then filters. Runs before it, not instead of it.

meg

Another tomnomnom tool that fetches many paths per host. httprobe only checks liveness.

faq

httprobe questions

httprobe reads domains from standard input, so the usual invocation is `cat domains.txt | httprobe`. Add -c to raise concurrency and -t to set a per-request timeout in milliseconds. On Trickest, wire a domains file into the node domains input.

Run httprobe yourself

A domain feeds subfinder, whose subdomains httprobe filters down to the live HTTP and HTTPS hosts before they land as a queryable output.

Run httprobe in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

domains

FILE

List of domains to probe, one per line, read from standard input.

threads

STRING

-c

Number of concurrent workers (default 20).

timeout

STRING

-t

Per-request timeout in milliseconds (default 10000).

prefer-https

BOOLEAN

--prefer-https

Skip the HTTP check when HTTPS already responds.

protocol-port

STRING

-p

Add an extra probe for a protocol:port pair beyond the defaults, e.g. http:8080.

skip-standard-ports

BOOLEAN

-s

Skip the default HTTP:80 and HTTPS:443 probes and test only the ports you name.

Name

Type

Flag

Description

domains

FILE

List of domains to probe, one per line, read from standard input.

threads

STRING

-c

Number of concurrent workers (default 20).

timeout

STRING

-t

Per-request timeout in milliseconds (default 10000).

prefer-https

BOOLEAN

--prefer-https

Skip the HTTP check when HTTPS is already working.

protocol-port

STRING

-p

Add an extra probe for a protocol:port pair beyond the port 80 and port 443 defaults, e.g. http:8080.

protocol-port-2

STRING

-p

A second protocol:port slot for adding another non-standard port to probe.

skip-standard-ports

BOOLEAN

-s

Skip the default HTTP:80 and HTTPS:443 probes and test only the protocol:port pairs you specify.

Thin a domain list to live HTTP and HTTPS hosts

What httprobe does

Where httprobe fits

Filter a subdomain list to live hosts

Find HTTP and HTTPS quickly

Probe non-standard ports

Prefer HTTPS for speed

httprobe inputs and flags

Run httprobe

Choosing httprobe

httpx

subfinder

meg

httprobe questions

More Network tools

asnmap

dnsvalidator

fping

httpx

mapcidr

masscan

Run httprobe yourself

Thin a domain list to live HTTP and HTTPS hosts

What httprobe does

Where httprobe fits

Filter a subdomain list to live hosts

Find HTTP and HTTPS quickly

Probe non-standard ports

Prefer HTTPS for speed

httprobe inputs and flags

Run httprobe

Choosing httprobe

httpx

subfinder

meg

httprobe questions

More Network tools

asnmap

dnsvalidator

fping

httpx

mapcidr

masscan

Run httprobe yourself