Recon
Pull passive subdomains from the jldc.me Anubis dataset
Passive subdomain lookup against the jldc.me Anubis API.
overview
What jldc-subdomains does
jldc-subdomains queries the jldc.me Anubis API for names recorded under one domain. The request hits a third-party dataset, not the target, so enumeration stays passive.
One domain input; file and folder of subdomains out. No CLI flags. Stack it with crtsh, hackertarget, and other single-source finders, then deduplicate before resolve.
Trickest provides jldc-subdomains as a managed Recon node. Use it as an extra passive feed in a subdomain sweep. Prefer subfinder when you want many passive sources in one tool.
use cases
Where jldc-subdomains fits
Add a passive source to enumeration
Query jldc.me for a domain and merge the results with other passive finders so the combined subdomain set covers more of the footprint.
Map a footprint without touching the target
Pull subdomains from a third-party dataset so the discovery step stays quiet and sends no traffic to the organization being mapped.
Seed a resolve-and-probe pipeline
Hand the discovered names to a DNS resolver and httpx so the workflow continues only against subdomains that resolve and respond.
Diff for new subdomains over time
Run jldc-subdomains on a schedule and compare runs to flag names that appear in the dataset as the footprint changes.
reference
jldc-subdomains inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Domain to get results from the jldc.me API. |
Showing key inputs. jldc-subdomains exposes 1 inputs in total.
example
Run jldc-subdomains
# query jldc.me Anubis for a domain's subdomains
jldc-subdomains example.comapi.example.com
app.example.com
cdn.example.com
dev.example.com
mail.example.com
staging.example.com
vpn.example.com
www.example.comguidance
Choosing jldc-subdomains
Use jldc-subdomains as one passive feed in a broader subdomain enumeration, merged with other sources for coverage. It returns names from a dataset; it does not resolve or probe them. Follow with a resolver and httpx. For a multi-source passive sweep, subfinder is the aggregate peer.
subfinder
Aggregates many passive sources at once. jldc-subdomains is a single dedicated feed you can stack beside it.
certsh-subdomains
Pulls names from certificate transparency logs. Another single-source passive feed to merge in.
assetfinder
Lightweight passive finder across a few sources. Combine its output with jldc for wider coverage.
faq
jldc-subdomains questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run jldc-subdomains yourself
A domain feeds jldc-subdomains, which pulls subdomains from jldc.me and passes them to httpx so only live names land as output.
Facts on this page come from the live Trickest tool library.