Add Reconeer

[dogancanbakir]

https://www.reconeer.com/

[coderabbitai]

📝 CodeRabbit Plan Mode

Generate an implementation plan and prompts that you can use with your favorite coding agent.

• Create Plan

Examples

• Example 1
• Example 2

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord or schedule a call!

[reconeer]

Reconeer https://github.com/reconeer/reconeer (also you can render in the website https://www.reconeer.com ) finds subdomains from other sources than subfinder.

Focused mainly on bug bounty domains. Also focused on European platforms : Yeswehack, Intigriti, Yogosha...

python3 reconeer_vs_subfinder.py

[*] Enumerating subdomains for post.ch

[*] Running subfinder...
[+] subfinder: 1494 subdomains

[*] Running reconeer...
[+] reconeer: 2829 subdomains

[+] Union total: 2897
[+] Overlapping: 1426
[+] Unique to reconeer: 1403

[*] Resolving reconeer-only FQDNs...

[+] Resolved reconeer-only subdomains (115):
    admin.incamail-prod.post.ch -> 194.41.184.117
    awrelay3.post.ch -> 194.41.216.149
    awuagint.post.ch -> 194.41.144.139
    azc-url-redirects-poc.post.ch -> 13.107.246.44
    cepr00.post.ch -> 84.246.232.10
    cert.webstamp.post.ch -> 194.41.184.188
    cert.ws.ssoint.post.ch -> 194.41.248.60
    cert.wspartner.ssoint.post.ch -> 194.41.248.59
    cert.wsredesignint1.post.ch -> 194.41.248.65
    cnd.post.ch -> 217.71.89.57
    consumo.post.ch -> 194.41.195.162
    content-ci360-i.post.ch -> 82.78.147.57
    content-ci360-p.post.ch -> 82.78.147.34
    cs1int1.post.ch -> 194.41.253.223
    cs1int2.post.ch -> 194.41.255.32
    cvpnzf.post.ch -> 194.41.209.248
    dmr-int.post.ch -> 172.28.73.11
    dmr-prod.post.ch -> 172.18.73.16
    dms.post.ch -> 194.41.184.146
    ead.wsredesignint1.post.ch -> 194.41.248.65
    ead.wsredesignint2.post.ch -> 194.41.248.82
    enterpriseenrollment.post.ch -> 52.236.189.96
    enterpriseregistration.post.ch -> 40.126.32.6
    epr.ag.preprod.post.ch -> 194.41.249.79
    epr.ti.preprod.post.ch -> 194.41.184.166
    experience-hub.post.ch -> 217.71.89.187
    fds.post.ch -> 194.41.152.153
    fds2.post.ch -> 194.41.152.161
    fgz.post.ch -> 194.41.152.143
    fwzfap.post.ch -> 194.41.209.156
    gordon-6-42-67-8.wsredesignint1.post.ch -> 194.41.248.65
    gvee02a.ucint.post.ch -> 194.41.152.188
    gvie01.post.ch -> 194.41.152.169
    gvie01.ucint.post.ch -> 194.41.152.169
    gvie02a.uc.ucint.post.ch -> 194.41.152.163
    gviee01a.ucint.post.ch -> 194.41.152.182
    gviee02a.ucint.post.ch -> 194.41.152.186
    gvife01a.ucint.post.ch -> 194.41.216.165
    gw1.incamail-prod.post.ch -> 194.41.147.13
    gw2.incamail-int.post.ch -> 194.41.147.12
    halloween.post.ch -> 194.41.184.144
    honey-paypal.wsredesignint1.post.ch -> 194.41.248.65
    idcheck-webrtctest.post.ch -> 194.41.152.139
    infocard.post.ch -> 62.204.127.180
    intpa-cms.post.ch -> 194.41.248.35
    ipv6-c153-bos001-ix.wsredesignint1.post.ch -> 194.41.248.65
    jim.post.ch -> 194.41.152.199
    karriere.post.ch -> 194.41.185.38
    klp-help2.post.ch -> 194.41.190.122
    kmuint1.post.ch -> 194.41.253.223
    kmuint2.post.ch -> 194.41.255.32
    live.post.ch -> 194.41.152.157
    lms.post.ch -> 194.41.184.144
    locatee-int.post.ch -> 34.65.139.17
    mapserviceint.post.ch -> 194.41.248.64
    net.post.ch -> 194.41.184.10
    ngate3.post.ch -> 194.41.144.139
    outproxy3.post.ch -> 194.41.216.154
    pa-be.externint.post.ch -> 194.41.248.163
    pf37wiki.post.ch -> 194.41.184.13
    pfworkspaceinet.post.ch -> 194.41.159.25
    pm-strategie-visualisiert-intranet-version.post.ch -> 80.74.142.144
    post.ch -> 194.41.184.148
    ppm.post.ch -> 194.41.184.144
    promoposttoolint.post.ch -> 194.41.248.74
    provisioning.incamail-prod.post.ch -> 194.41.184.117
    pwwexint.post.ch -> 194.41.194.10
    quickcalculator.post.ch -> 194.41.184.144
    rascitrix2int.post.ch -> 194.41.248.169
    saferpay-int.post.ch -> 194.41.223.12
    sanela-health.post.ch -> 194.41.184.63
    sapmsvor.post.ch -> 155.56.210.190
    sapsps-int.post.ch -> 194.41.196.149
    sapsps.post.ch -> 194.41.132.149
    sdmint.post.ch -> 194.41.248.50
    sdmklppartner.post.ch -> 194.41.248.227
    sdmpartner.post.ch -> 194.41.248.51
    secureshopint.post.ch -> 194.41.248.173
    siplyncint.post.ch -> 194.41.152.147
    sipskypezo.post.ch -> 194.41.216.158
    sorrywsint.post.ch -> 194.41.248.191
    ssi.post.ch -> 194.41.184.41
    stargate.post.ch -> 194.41.216.140
    static1.intpa-cms.post.ch -> 194.41.248.35
    static2.intpa-cms.post.ch -> 194.41.248.35
    strm-schema-registry.post.ch -> 3.121.134.0
    strm.post.ch -> 52.57.246.97
    tbs.post.ch -> 194.41.166.17
    tbspzf.post.ch -> 194.41.226.29
    test-rpz.post.ch -> 1.1.1.1
    testworkspaceone.post.ch -> 194.41.248.135
    toeggeliturnier.post.ch -> 80.74.155.40
    tpex.ucint.post.ch -> 194.41.152.163
    vemx05.post.ch -> 84.246.232.141
    vemx06.post.ch -> 84.246.236.129
    vepr05.post.ch -> 84.246.233.10
    vepr06.post.ch -> 84.246.233.11
    vepri5.post.ch -> 84.246.237.10
    vexedbe21.post.ch -> 194.41.158.143
    vexedbe22.post.ch -> 194.41.158.137
    vexedbei21.post.ch -> 194.41.158.153
    vexedzf13.post.ch -> 194.41.222.138
    vexedzf22.post.ch -> 194.41.222.147
    vpn-isa.post.ch -> 194.41.145.10
    webrtc.post.ch -> 194.41.152.188
    webservices-test.post.ch -> 194.41.222.137
    webtransfertest.post.ch -> 194.41.248.104
    werschreibtgewinnt.post.ch -> 81.18.24.184
    ws.incamail-prod.post.ch -> 194.41.184.117
    wsint.post.ch -> 194.41.248.64
    wspartner.ssoint.post.ch -> 194.41.248.58
    www.flyerservice.post.ch -> 194.88.197.5
    www.help.post.ch -> 64.239.123.193
    www.incamail-prod.post.ch -> 194.41.184.117
    xml.post.ch -> 194.41.184.91

[+] Special DNS-only records (not A-resolvable):

[*] Done.

cat reconeer_vs_subfinder.py
#!/usr/bin/env python3

import subprocess
import socket
import sys
from typing import Set, Dict

=========================

Validation helpers

=========================

def is_valid_hostname(hostname: str) -> bool:
if not hostname:
return False

hostname = hostname.strip().lower()

# Reject wildcards
if "*" in hostname:
    return False

# Max DNS length
if len(hostname) > 253:
    return False

labels = hostname.split(".")
for label in labels:
    if not label or len(label) > 63:
        return False
    if label.startswith("-") or label.endswith("-"):
        return False

try:
    hostname.encode("idna")
except UnicodeError:
    return False

return True

def classify_special(hostname: str) -> str | None:
specials = [
"_dmarc.",
"_spf.",
"_dkim.",
"_acme-challenge.",
"_smtp._tls.",
"_sip.",
"_imaps.",
"_pop3s.",
]
for s in specials:
if hostname.startswith(s):
return s[:-1]
return None

=========================

Enumeration tools

=========================

def run_subfinder(domain: str) -> Set[str]:
try:
result = subprocess.run(
["subfinder", "-d", domain, "-silent"],
capture_output=True,
text=True,
check=True
)
return {line.strip().lower() for line in result.stdout.splitlines() if line.strip()}
except FileNotFoundError:
print("[!] subfinder not found")
sys.exit(1)
except subprocess.CalledProcessError as e:
print(f"[!] subfinder error: {e.stderr}")
return set()

def run_reconeer(domain: str) -> Set[str]:
try:
result = subprocess.run(
["reconeer", "-d", domain],
capture_output=True,
text=True,
check=True
)
return {line.strip().lower() for line in result.stdout.splitlines() if line.strip()}
except FileNotFoundError:
print("[!] reconeer not found")
sys.exit(1)
except subprocess.CalledProcessError as e:
print(f"[!] reconeer error: {e.stderr}")
return set()

=========================

DNS Resolution

=========================

def resolve_subdomains(subdomains: Set[str]) -> Dict[str, str]:
resolved = {}

for sub in subdomains:
    if not is_valid_hostname(sub):
        continue
    try:
        ip = socket.gethostbyname(sub)
        resolved[sub] = ip
    except (socket.gaierror, UnicodeError):
        pass

return resolved

=========================

Main logic

=========================

def main(domain: str = "post.ch"):
print(f"\n[*] Enumerating subdomains for {domain}\n")

print("[*] Running subfinder...")
subfinder_subs = run_subfinder(domain)
print(f"[+] subfinder: {len(subfinder_subs)} subdomains\n")

print("[*] Running reconeer...")
reconeer_subs = run_reconeer(domain)
print(f"[+] reconeer: {len(reconeer_subs)} subdomains\n")

union = subfinder_subs | reconeer_subs
overlap = subfinder_subs & reconeer_subs
unique_to_reconeer = reconeer_subs - subfinder_subs

print(f"[+] Union total: {len(union)}")
print(f"[+] Overlapping: {len(overlap)}")
print(f"[+] Unique to reconeer: {len(unique_to_reconeer)}\n")

# Classify specials
special_records: Dict[str, Set[str]] = {}
fqdn_candidates = set()

for sub in unique_to_reconeer:
    special = classify_special(sub)
    if special:
        special_records.setdefault(special, set()).add(sub)
    else:
        fqdn_candidates.add(sub)

print("[*] Resolving reconeer-only FQDNs...")
resolved = resolve_subdomains(fqdn_candidates)

print(f"\n[+] Resolved reconeer-only subdomains ({len(resolved)}):")
for sub, ip in sorted(resolved.items()):
    print(f"    {sub} -> {ip}")

print("\n[+] Special DNS-only records (not A-resolvable):")
for k, v in special_records.items():
    print(f"\n  {k} ({len(v)})")
    for s in sorted(v):
        print(f"    {s}")

print("\n[*] Done.")

=========================

Entry

=========================

if name == "main":
if len(sys.argv) > 1:
main(sys.argv[1])
else:
main()
``

[dogancanbakir]

@reconeer Thanks a lot for the input! Looking at the docs, API key configuration part is missing, also it would be great if you could share rate limits?

[reconeer]

Thanks a lot for the feedback!

I've updated the documentation to clearly cover:

• API usage and endpoints
• Authentication behavior (API key is optional, via X-API-Key)
• Rate limits: 100 requests per 15 minutes, applied per IP + API key

Reconeer is a passive-only data source (no brute-force, DNS guessing, or active probing).

Docs:
https://reconeer.com/docs.html

If you’d like anything clarified or adjusted further for Subfinder integration, I’m happy to update it.

[dogancanbakir]

@reconeer Thanks for the update! I've just raised the PR.

[dogancanbakir]

Btw, it'll require an API key since we don't support optional API keys. But, I've opened another issue to track that #1695

[dogancanbakir]

@reconeer fyi, https://discord.com/channels/695645237418131507/1461089682493280337/1461089682493280337

[reconeer]

@dogancanbakir I assume it's the issue with the current availability. Should be up soon, working on a fix. I cannot see the discord chat messages. Can you send me an invite contact@reconeer.com ? Thanks!

[dogancanbakir]

You can join via https://discord.gg/projectdiscovery