projectdiscovery/subfinder · warning

observed host results truncated for source

Error message

observed host results truncated for source %q, more exist

What it means

This error is emitted by enumerateObservedHosts when the scanmalware API response body flags a particular upstream source as truncated (body.Truncated[source] is true). The library forwards one Error Result per truncated source so consumers know the observed-host set is incomplete for those sources. The %q verb names which upstream source was cut short.

Solutions

1. Re-query the affected domain with narrower scope so each upstream source's data fits within limits.
2. Upgrade the scanmalware API plan if per-source record caps are account-tier dependent.
3. Merge results from other sources to compensate for the incomplete truncated source.

When it happens

Trigger: The scanmalware observed-hosts API response contains Truncated[source] = true for one or more upstream data sources, typically when the domain's observed host data exceeds the API's per-source limits.

Common situations: Querying large domains whose passive-DNS / observed-host data exceeds API page or record caps; API-side quota or scope limits clipping results for popular domains.

Related errors

• archive results truncated after
• %s
• unexpected status code
• request failed with status
• request failed with status

AI-assisted analysis of projectdiscovery/subfinder@7a0b91f0fa (2026-09-06). Data as JSON: /api/errors/2747387a3b84daee. Report an issue: GitHub.

Appendix: source

Thrown at pkg/subscraping/sources/scanmalware/scanmalware.go:224

		session.DiscardHTTPResponse(resp)
		return
	}

	var body hostsResponse
	err = jsoniter.NewDecoder(resp.Body).Decode(&body)
	if err != nil {
		results <- subscraping.Result{Source: s.Name(), Type: subscraping.Error, Error: err}
		s.errors++
		s.closeBody(resp, results)
		return
	}
	s.closeBody(resp, results)

	for source, truncated := range body.Truncated {
		if truncated {
			results <- subscraping.Result{
				Source: s.Name(), Type: subscraping.Error,
				Error: fmt.Errorf("observed host results truncated for source %q, more exist", source),
			}
			s.errors++
		}
	}

	s.emit(ctx, body.Subdomains, session, results)
}

// closeBody closes a response body and reports a close error the same way the rest
// of the sources do, rather than discarding it.
func (s *Source) closeBody(resp *http.Response, results chan subscraping.Result) {
	if err := resp.Body.Close(); err != nil {
		results <- subscraping.Result{Source: s.Name(), Type: subscraping.Error, Error: err}
		s.errors++
	}
}

// hostOf returns the hostname of a URL, or an empty string.

View on GitHub (pinned to 7a0b91f0fa)