ScanMalware is Now a Built-In Subfinder Source - ScanMalware Blog

ScanMalware ships with subfinder now

subfinder is ProjectDiscovery's passive subdomain enumeration tool, and for a lot of people it is the first thing that runs at the start of an engagement. As of v2.16.0, released on 22 August 2026, ScanMalware is one of its built-in passive sources.

It is enabled by default and it needs no API key. If you already have subfinder installed, update it and you are done:

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
subfinder -d example.com

To run only this source:

subfinder -d example.com -s scanmalware

To confirm it is present in your build:

subfinder -ls | grep scanmalware

Sources marked with a * in that list require a key or token. ScanMalware is not one of them — it works on a clean install with an empty config, which is how most people actually run subfinder.

What it queries

Most passive sources wrap a single dataset. This one queries three, because they contain genuinely different things, and a host missing from one can still turn up in another.

Three data sources merged into one subdomain list

Certificate transparency. Subdomains observed in CT DNS records. This is the enumeration workhorse and carries the bulk of the answer for most domains.

The public scan archive. Hosts that appear in pages we have actually scanned. This is not redundant with CT: a host that was scanned but never held a publicly logged certificate appears only here.

Browser-observed hosts. The hosts a real browser resolved and requested while rendering pages on the domain. This is a third population again — internal, dev and staging hosts that hold no certificate and were never scanned directly show up only in this set.

The three queries are independent, and a failure in one does not skip the others. Only a cancelled run stops the source early.

Truncation is reported, not hidden

Each of the three queries has a cap. When a cap is hit, the source emits an explicit error result rather than handing back a shortened list as though it were the complete one:

results truncated at 5000 subdomains, more exist

That distinction matters more than it sounds. A passive source that silently returns a partial answer is worse than one that returns nothing, because you have no way to know you are looking at a subset. If you see that message, the domain has more subdomains than the cap allows and it is worth querying the API directly.

What is behind it

The certificate transparency side is the largest of the three and covers years of logged issuance. The scan archive adds hosts seen in pages that were actually loaded and rendered rather than merely resolved.

Because the archive is built from real page loads, the browser-observed set contains hosts that never appear in any certificate log and were never submitted for scanning by anyone — they were simply contacted by a page that was.

Coverage varies enormously by domain, which is the honest way to describe any passive source. Rather than take our word for it, run the calls in the next section against a domain you already know well and compare the answer to what you expect — that is a far better test of a passive source than any number we could print here.

Does it actually find anything the others miss?

That is the only question worth asking about a new passive source, so we measured it rather than asserting it. Eighty domains, each enumerated twice with subfinder v2.16.0 — once with only this source (-s scanmalware) and once with every other source but this one (-es scanmalware) — then compared the two host sets.

Across all 80 domains the source contributed 401 subdomains that no other source returned, a 14% increase on their combined 2,868.

A single large domain can flatter a number like that, so we checked: dropping the biggest contributor still leaves +12.7%. The effect is spread across the sample, not carried by one lucky result.

Share of the merged subdomain list that only the ScanMalware source found

Half the sample was drawn from ordinary enumeration targets, and most of those are parked or dead — 26 of 60 returned nothing from any source, which is simply what passive enumeration looks like in the wild. On the half with real infrastructure the picture is clearer: the source added something unique on 14 of 18 domains that returned anything at all, contributing a median 14% of the merged list. evergage.com is the extreme case — 61 hosts from us against 20 from everyone else, 57 of which nobody else had, nearly all of them per-tenant subdomains that only exist in certificate logs.

One caveat, stated plainly: we ran this with no API keys configured, so the comparison is against subfinder's 15 keyless sources, not the 37 that need a key. A fully-keyed install has more to work with and the gap would narrow. Read this as "what the source adds to a default install", which is how most people run subfinder — not as a claim about a maximal one.

No key, no signup

The source works on a clean install because the endpoints it uses are anonymous. An API key exists and raises limits, but nothing about the subfinder integration requires one. Passive reconnaissance is what this data is for, so if the integration is useful to you, use it.

Using the API directly

Everything the source does is a public endpoint you can call yourself. Certificate transparency subdomains:

curl "https://scanmalware.com/api/v1/ct/dns/example.com?subdomain_limit=5000"

Hosts a browser actually contacted while rendering the domain:

curl "https://scanmalware.com/api/v1/hosts/example.com?subdomains_only=true"

The scan archive, via SMQL:

curl "https://scanmalware.com/api/v1/search/smql?q=domain:*.example.com&limit=100"

The hosts endpoint reports its results grouped by how each host was found, so you can tell a host the browser genuinely requested from one that was merely named in a page's content security policy or extracted from script source. The subfinder source deliberately uses only the first group: static extraction produces a lot of hosts that were never contacted, and subfinder has no way to carry that distinction through to you.

Where this fits

Passive enumeration is a coverage problem, not a cleverness problem. No single source sees everything, which is why subfinder queries dozens in parallel and merges the results. The useful question for any new source is not "is it good" but "does it see anything the others do not".

Certificate transparency is well covered by existing sources. The parts of this integration that are genuinely additive are the scan archive and the browser-observed hosts — hosts that exist because someone loaded a page, not because someone issued a certificate.