loading
Loading content
loading
Recon
Passive subdomain lookup against the jldc.me Anubis API.
overview
jldc-subdomains queries the jldc.me Anubis API for names recorded under one domain. The request hits a third-party dataset, not the target, so enumeration stays passive.
One domain input; file and folder of subdomains out. No CLI flags. Stack it with crtsh, hackertarget, and other single-source finders, then deduplicate before resolve.
Trickest provides jldc-subdomains as a managed Recon node. Use it as an extra passive feed in a subdomain sweep. Prefer subfinder when you want many passive sources in one tool.
use cases
Query jldc.me for a domain and merge the results with other passive finders so the combined subdomain set covers more of the footprint.
Pull subdomains from a third-party dataset so the discovery step stays quiet and sends no traffic to the organization being mapped.
Hand the discovered names to a DNS resolver and httpx so the workflow continues only against subdomains that resolve and respond.
Run jldc-subdomains on a schedule and compare runs to flag names that appear in the dataset as the footprint changes.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Domain to get results from the jldc.me API. |
Showing key inputs. jldc-subdomains exposes 1 inputs in total.
example
# query jldc.me Anubis for a domain's subdomainsjldc-subdomains example.comapi.example.comapp.example.comcdn.example.comdev.example.commail.example.comstaging.example.comvpn.example.comwww.example.comguidance
Use jldc-subdomains as one passive feed in a broader subdomain enumeration, merged with other sources for coverage. It returns names from a dataset; it does not resolve or probe them. Follow with a resolver and httpx. For a multi-source passive sweep, subfinder is the aggregate peer.
Aggregates many passive sources at once. jldc-subdomains is a single dedicated feed you can stack beside it.
Pulls names from certificate transparency logs. Another single-source passive feed to merge in.
Lightweight passive finder across a few sources. Combine its output with jldc for wider coverage.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain feeds jldc-subdomains, which pulls subdomains from jldc.me and passes them to httpx so only live names land as output.
Facts on this page come from the live Trickest tool library.