subfinder: a source count is not a confidence score

The brackets are a list

A line can show a hostname and, in brackets, the sources that reported it on this run. Three names in the brackets means three datasets returned the hostname. It does not mean three live checks, and it does not mean the name is three times as important as a name with one source.

A single source is still a report from that source. It is not a weak rumor you may drop without saying you dropped it, and it is not proof the name is current. The line does not include the date the source first saw the name.

Do not turn the count into a score

Sorting the inventory by how many sources appear is a choice you document. It is not a field subfinder computed as confidence. If you keep only names with two or more sources, write that filter. The names you removed are still in the raw output.

Do not write “confirmed” because the list is long. Confirmation would be a resolution or an owner, cited separately.

What to file

File the hostname, the source names, and the run time. If you mention a count, show the list it came from. Do not file a 1-to-5 score that is not on the line.

Worked case: three sources called confirmed

labs-status.hackblue-lab.org is printed with crt.sh, certspotter, and anubis. A draft marks it “confidence high” and adds it to the live web inventory. No resolution was run. The line has no dates.

The note lists the three source names and the run time. It says the count is the length of that list, not a confidence score, and the name was not resolved in this step. The live inventory does not gain the host from the count alone.

host: labs-status.hackblue-lab.org
sources: crt.sh, certspotter, anubis
count: 3, which is the length of that list
resolution: not run
not: confidence high, and not a live web host