{"record":{"id":"2747387a3b84daee","repo":"projectdiscovery/subfinder","slug":"observed-host-results-truncated-for-source-q-mor","errorCode":null,"errorMessage":"observed host results truncated for source %q, more exist","messagePattern":"observed host results truncated for source %q, more exist","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/subscraping/sources/scanmalware/scanmalware.go","lineNumber":224,"sourceCode":"\t\tsession.DiscardHTTPResponse(resp)\n\t\treturn\n\t}\n\n\tvar body hostsResponse\n\terr = jsoniter.NewDecoder(resp.Body).Decode(&body)\n\tif err != nil {\n\t\tresults <- subscraping.Result{Source: s.Name(), Type: subscraping.Error, Error: err}\n\t\ts.errors++\n\t\ts.closeBody(resp, results)\n\t\treturn\n\t}\n\ts.closeBody(resp, results)\n\n\tfor source, truncated := range body.Truncated {\n\t\tif truncated {\n\t\t\tresults <- subscraping.Result{\n\t\t\t\tSource: s.Name(), Type: subscraping.Error,\n\t\t\t\tError: fmt.Errorf(\"observed host results truncated for source %q, more exist\", source),\n\t\t\t}\n\t\t\ts.errors++\n\t\t}\n\t}\n\n\ts.emit(ctx, body.Subdomains, session, results)\n}\n\n// closeBody closes a response body and reports a close error the same way the rest\n// of the sources do, rather than discarding it.\nfunc (s *Source) closeBody(resp *http.Response, results chan subscraping.Result) {\n\tif err := resp.Body.Close(); err != nil {\n\t\tresults <- subscraping.Result{Source: s.Name(), Type: subscraping.Error, Error: err}\n\t\ts.errors++\n\t}\n}\n\n// hostOf returns the hostname of a URL, or an empty string.","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/projectdiscovery/subfinder/blob/7a0b91f0fac01b62c65328bd771a3560ae611d6a/pkg/subscraping/sources/scanmalware/scanmalware.go#L206-L242","documentation":"This error is emitted by enumerateObservedHosts when the scanmalware API response body flags a particular upstream source as truncated (body.Truncated[source] is true). The library forwards one Error Result per truncated source so consumers know the observed-host set is incomplete for those sources. The %q verb names which upstream source was cut short.","triggerScenarios":"The scanmalware observed-hosts API response contains Truncated[source] = true for one or more upstream data sources, typically when the domain's observed host data exceeds the API's per-source limits.","commonSituations":"Querying large domains whose passive-DNS / observed-host data exceeds API page or record caps; API-side quota or scope limits clipping results for popular domains.","solutions":["Re-query the affected domain with narrower scope so each upstream source's data fits within limits.","Upgrade the scanmalware API plan if per-source record caps are account-tier dependent.","Merge results from other sources to compensate for the incomplete truncated source."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Parse the source name from the error message to know which upstream dataset was incomplete.","Track truncated sources per domain and re-query with narrower scope.","Ensure your API plan's per-source limits match your enumeration volume."],"tags":["network","api-response","truncated-results","subdomain-enumeration"],"backgroundTag":"results-truncated","analyzedSha":"7a0b91f0fac01b62c65328bd771a3560ae611d6a","analyzedAt":"2026-09-06T23:52:02.109Z","contentChangedAt":"2026-09-06T23:52:02.109Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}