subfinder: a hostname line is a source report, not a live host

The line is someone else’s record

subfinder prints hostnames that certificate logs and other passive datasets already contain. A line with a source in brackets means that source returned the name during this run. It does not mean the name resolves now, that a certificate is still valid, or that your team is serving a site there.

Two sources on one line still are not a live check. They are two records. A resolution, if you need one, is a separate lookup you cite on its own.

What to put under the line

Write the domain you asked about, the UTC time of the run, the hostname, and the sources printed beside it. Write that the run did not connect to the host. If you later look the name up, write the lookup result next to the line instead of editing the line into a stronger claim.

Do not add the name to a production inventory as “exposed” from this line alone. Do not paste a pile of names into a ticket without the sources.

One old source is a weaker record

A name that appears from a single certificate log may be years old. The line does not carry the certificate’s dates. Calling it current is a guess. Keep it on the passive list, labeled with that one source, until a fresher record or a resolution says more.

Worked case: a VPN name that does not resolve

The lab run at 2026-11-03T09:10:00Z prints labs-vpn.hackblue-lab.org with only crt.sh in the source list. A draft adds “live VPN” to the asset register. A DNS lookup from the admin workstation returns no address.

The note quotes the hostname, the source, and the run time, and then the lookup: no address. The name stays on the passive list as a historical certificate name. It is not inventoried as a running service, and nobody is asked to treat it as exposed.

run: 2026-11-03T09:10:00Z  domain: hackblue-lab.org
host: labs-vpn.hackblue-lab.org
sources: crt.sh
connected to the host: no
lookup after the run: no address
write: historical name from that source, not a live service