Resolve subdomain wordlists through open resolvers

subbrute takes a domain and a --subs wordlist of candidate labels, then resolves each name. It finds hosts that never appear in certificate logs, search indexes, or DNS aggregators because those sources only list what was already published.

Lookups go through a pool of open resolvers via --resolvers instead of the target name servers. That spreads query load and keeps brute-force traffic off the zone's infrastructure. Raise --process_count when the wordlist is large; pass --targets to brute several domains in one run.

Reach for it after a passive pass such as subfinder has run dry. Trickest runs subbrute as a managed Recon node that writes resolved names to a file and folder. Merge with passive results, then probe with httpx. It resolves names; it does not fetch HTTP.