Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Recon

Pull passive subdomains for a root domain

Passive SecurityTrails subdomain list for one root domain.

Agent
Expand scope passivelyFind dormant or retired hostsSeed an active enumerator

overview

What securitytrails-subdomains does

securitytrails-subdomains asks SecurityTrails for hostnames under a root-domain and parses them into a flat list. Inputs are root-domain and api-key. Output is FILE and FOLDER.

The lookup is passive: no traffic to target resolvers. Use it as an early recon seed, or merge with active brute-force so dormant and live names both appear before probing.

Trickest runs it as a managed Recon node. Pair with shuffledns for resolution, or switch to securitytrails-sql when you need arbitrary scroll filters beyond one root.

use cases

Where securitytrails-subdomains fits

Expand scope passively

Pull SecurityTrails subdomains for a root domain to grow the target list without sending a request to the target's infrastructure.

Find dormant or retired hosts

Surface subdomains from passive DNS history that no longer appear in live resolution but may still answer or leak information.

Seed an active enumerator

Feed the SecurityTrails set into a brute-force tool so its wordlist run starts from known-good hosts and finds more siblings.

Cross-source subdomain coverage

Merge this output with crawler and certificate-transparency results so the final host list draws on several independent sources.

reference

securitytrails-subdomains inputs and flags

2 inputs
NameTypeFlagDescription
root-domainSTRING·Root domain to find and parse subdomains from response
api-keySTRING·SecurityTrails API key

Showing key inputs. securitytrails-subdomains exposes 2 inputs in total.

example

Run securitytrails-subdomains

securitytrails-subdomains · command
# securitytrails-subdomains: passive pull for example.com (api-key as node input)# root-domain: example.com# writes one subdomain per line for downstream resolvers
sample output
www.example.comapi.example.commail.example.comstaging.example.comdev.example.comcdn.example.comvpn.example.comportal.example.comstatus.example.com

guidance

Choosing securitytrails-subdomains

Use when you want a quiet SecurityTrails subdomain list for one root-domain with no target traffic. Prefer securitytrails-sql for arbitrary scroll queries. Pair with shuffledns when you need active brute-force resolution.

securitytrails-sql

Same source with full query control. Use when a flat subdomain list is not enough.

shuffledns

Active brute-force and resolution. Feed it the passive set as known seeds.

shodan-python

Service and device intel, not DNS inventory. A different lens on the same target.

faq

securitytrails-subdomains questions

No. The call hits only the SecurityTrails API. Target resolvers and servers see nothing.

related

More Recon tools

  1. amass

    Multi-source subdomain discovery; hand names to httpx.

  2. amass-intel

    OWASP Amass intel: map an organization's root domains and ranges.

  3. assetfinder

    Find domains and subdomains potentially related to a given domain.

  4. bbot

    Modular OSINT recon that chains modules from a seed target.

  5. bevigil

    CLI client for the BeVigil OSINT API, keyed by domain or app package.

  6. cloud-enum

    Multi-cloud public name enumeration for AWS, Azure, and GCP.

Run securitytrails-subdomains yourself

A root domain feeds securitytrails-subdomains, whose passive set seeds shuffledns to resolve and confirm the final subdomain list.

Open securitytrails-subdomains in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.