How do I keep a scan focused?

Select modules by use case with -u, restrict to your target type with -x, or choose the event types you want with -t and let spiderfoot enable matching modules.

Do modules need API keys?

Some modules query services that require keys. Pass them in --config; modules without key requirements still run.

Which output formats are available?

Tab (default), CSV, or JSON via -o. Use -D to change the CSV delimiter, -H to omit headers, and -r to include the source data field.

How is spiderfoot different from subfinder?

subfinder focuses on passive subdomain names. spiderfoot runs a wider OSINT module set across many event types, at the cost of a heavier run.

Can I limit concurrency?

Yes. Set -max-threads to cap how many modules run at once, which helps when API-backed modules would otherwise stampede rate limits.

Updated Jul 15, 2026

Recon

Correlate OSINT events from one seed target

Automated OSINT modules for attack surface mapping.

Map a target's full footprint Run targeted, stealthy collection Collect specific event types

overview

What spiderfoot does

In a Trickest workflow, spiderfoot takes a -s seed (domain, IP, host, or email) and writes a file plus a folder of correlated events.

Reach for it when one seed should fan across many passive sources, not when you only need subdomain names.

Select modules with -m, use cases with -u, event types with -t, or strict -x so only consumers of the seed type run. Many modules need keys in --config.

source github.com/smicallef/spiderfoot

use cases

Where spiderfoot fits

Map a target's full footprint

Run a broad module set against a domain to collect subdomains, IPs, related hosts, leaked data, and infrastructure into one correlated dataset.

Run targeted, stealthy collection

Use -x strict mode so only modules that consume your target type directly fire, keeping the run quiet and the results focused.

Collect specific event types

Select the event types you care about with -t and let spiderfoot enable the modules that produce them, instead of running everything.

Feed enrichment and reporting

Emit JSON or CSV with -o and route spiderfoot events into a downstream pipeline that dedupes, enriches, and reports on the surface it found.

reference

spiderfoot inputs and flags

17 inputs

Name	Type	Flag	Description
target	STRING	-s	Target for the scan, such as a domain, IP, host, or email.
modules	STRING	-m	Modules to enable (mod1,mod2,...).
use-case	STRING	-u	Select modules automatically by use case.
event-types	STRING	-t	Event types to collect; modules are selected automatically (type1,type2,...).
output-format	STRING	-o	Output format: tab (default), csv, or json.
strict-mode	BOOLEAN	-x	Only enable modules that can directly consume your target. Overrides -t and -m.
config	FILE	--config	API config file for module credentials.
max-threads	STRING	-max-threads	Max number of modules to run concurrently.

Showing key inputs. spiderfoot exposes 17 inputs in total.

Full flag reference (17 inputs)

Name	Type	Flag	Description
debug	BOOLEAN	--debug	Enable debug output.
config	FILE	--config	API config file
filter	BOOLEAN	-f	Filter out other event types that weren't requested.
target	STRING	-s	Target for the scan.
modules	STRING	-m	Modules to enable (mod1,mod2,...).
use-case	STRING	-u	Select modules automatically by use case
delimiter	STRING	-D	Delimiter to use for CSV output. Default is ,.
max-length	STRING	-S	Maximum data length to display. By default, all data is shown.
no-headers	BOOLEAN	-H	Don't print field headers, just data.
event-types	STRING	-t	Event types to collect; modules selected automatically (type1,type2,...).
max-threads	STRING	-max-threads	Max number of modules to run concurrently.
strict-mode	BOOLEAN	-x	Only enable modules that can directly consume your target, and if -t was specified only those events will be consumed by modules. This overrides -t and -m
output-format	STRING	-o	Output format. Tab is default. (tab,csv,json)
include-source	BOOLEAN	-r	Include the source data field in tab/csv output.
strip-newlines	BOOLEAN	-n	Strip newlines from data.
disable-logging	BOOLEAN	-q	Disable logging. This will also hide errors!
show-event-types	STRING	-F	Show only a set of event types, comma-separated.

example

Run spiderfoot

spiderfoot · command

# spiderfoot: footprint use-case against example.com, JSON outspiderfoot -s example.com -u footprint -o json -x -max-threads 8

sample output

example.comwww.example.comapi.example.commail.example.comstaging.example.comdev.example.com198.51.100.10203.0.113.25

guidance

Choosing spiderfoot

Use spiderfoot when a single seed should gather correlated OSINT across many sources. For passive subdomain names alone, prefer subfinder. Expect heavier runs, and supply API keys via --config for modules that need them.

subfinder

Passive subdomain names only. spiderfoot covers more event types at higher cost.

amass

DNS and infrastructure mapping. spiderfoot reaches further into non-DNS OSINT sources.

faq

spiderfoot questions

Domains, IP addresses, hostnames, subnets, emails, and names, among others. Pass the seed with -s and modules pick up the target types they can consume.

Run spiderfoot yourself

A target feeds spiderfoot, which runs its OSINT modules and writes the correlated findings as a queryable output.

Run spiderfoot in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

target

STRING

-s

Target for the scan, such as a domain, IP, host, or email.

modules

STRING

-m

Modules to enable (mod1,mod2,...).

use-case

STRING

-u

Select modules automatically by use case.

event-types

STRING

-t

Event types to collect; modules are selected automatically (type1,type2,...).

output-format

STRING

-o

Output format: tab (default), csv, or json.

strict-mode

BOOLEAN

-x

Only enable modules that can directly consume your target. Overrides -t and -m.

config

FILE

--config

API config file for module credentials.

max-threads

STRING

-max-threads

Max number of modules to run concurrently.

Name

Type

Flag

Description

debug

BOOLEAN

--debug

Enable debug output.

config

FILE

--config

API config file

filter

BOOLEAN

-f

Filter out other event types that weren't requested.

target

STRING

-s

Target for the scan.

modules

STRING

-m

Modules to enable (mod1,mod2,...).

use-case

STRING

-u

Select modules automatically by use case

delimiter

STRING

-D

Delimiter to use for CSV output. Default is ,.

max-length

STRING

-S

Maximum data length to display. By default, all data is shown.

no-headers

BOOLEAN

-H

Don't print field headers, just data.

event-types

STRING

-t

Event types to collect; modules selected automatically (type1,type2,...).

max-threads

STRING

-max-threads

Max number of modules to run concurrently.

strict-mode

BOOLEAN

-x

Only enable modules that can directly consume your target, and if -t was specified only those events will be consumed by modules. This overrides -t and -m

output-format

STRING

-o

Output format. Tab is default. (tab,csv,json)

include-source

BOOLEAN

-r

Include the source data field in tab/csv output.

strip-newlines

BOOLEAN

-n

Strip newlines from data.

disable-logging

BOOLEAN

-q

Disable logging. This will also hide errors!

show-event-types

STRING

-F

Show only a set of event types, comma-separated.

Correlate OSINT events from one seed target

What spiderfoot does

Where spiderfoot fits

Map a target's full footprint

Run targeted, stealthy collection

Collect specific event types

Feed enrichment and reporting

spiderfoot inputs and flags

Run spiderfoot

Choosing spiderfoot

subfinder

amass

spiderfoot questions

More Recon tools

amass

assetfinder

bevigil

cloud-enum

cloudlist

dnsrecon

Run spiderfoot yourself

Correlate OSINT events from one seed target

What spiderfoot does

Where spiderfoot fits

Map a target's full footprint

Run targeted, stealthy collection

Collect specific event types

Feed enrichment and reporting

spiderfoot inputs and flags

Run spiderfoot

Choosing spiderfoot

subfinder

amass

spiderfoot questions

More Recon tools

amass

assetfinder

bevigil

cloud-enum

cloudlist

dnsrecon

Run spiderfoot yourself