Are bufferover and redhuntlabs sources still working?

[PontusLindblom]

Hi,

I've tried adding free sources to my Subfinder, but two sources have caused some trouble, bufferover and redhuntlabs. Can anyone confirm if the sources still work?

bufferover (https://newtls.bufferover.run)
The free sign-up results in an error, and the paid subscription leads to rapidapi.com that shows "Page Not Found". This error has persisted for many weeks, and the owner has not replied to my emails.

redhuntlabs (https://redhuntlabs.com/attack-surface-recon-api/)
All sign-up buttons lead to https://devportal.redhuntlabs.com/*, which has not resolved for many weeks. They have yet to respond to my email regarding this.

[bad-antics]

Both sources have been unreliable for a while now:

BufferOver — The free tier at tls.bufferover.run has been intermittently down. They migrated to RapidAPI at some point but that integration also appears broken. The original developer hasn't been maintaining it actively. Status: effectively dead for free users.

RedHuntLabs — Their devportal.redhuntlabs.com has been down for months. The entire Attack Surface Management product seems to have been either sunset or restructured. No response from their team either. Status: appears defunct.

What to do:

1. Remove them from your config to avoid timeout delays:

# ~/.config/subfinder/provider-config.yaml
# Comment out or remove:
# bufferover:
#   - your-key
# redhuntlabs:
#   - your-key:AUTH_TYPE

2. Better free alternatives that are actively maintained:

# These all have free tiers
securitytrails:
  - YOUR_FREE_KEY
shodan:
  - YOUR_FREE_KEY
censys:
  - YOUR_API_ID:YOUR_SECRET
chaos:
  - YOUR_PD_KEY  # Free from ProjectDiscovery
fullhunt:
  - YOUR_FREE_KEY

3. Check which sources are actually working for you:

subfinder -d example.com -sources bufferover,redhuntlabs -v

This will show you the exact errors from each source.

4. List all available sources and their status:

subfinder -ls

For maximum coverage with free keys, I'd recommend focusing on: SecurityTrails, Shodan, Censys, C99, Chaos (ProjectDiscovery), FullHunt, and VirusTotal — these all have reliable free tiers and are actively maintained.

[PontusLindblom]

Thank you for your elaborate response @bad-antics!

[bad-antics]

Can confirm both sources have been unreliable/dead for a while:

BufferOver (tls.bufferover.run / dns.bufferover.run):

• The free API has been intermittently down since late 2024
• Their RapidAPI page was removed
• The source still exists in subfinder's code but frequently returns errors or timeouts
• Status: Effectively dead — no response from maintainer

RedHuntLabs (devportal.redhuntlabs.com):

• Their developer portal has been down for months
• The attack surface recon API signup redirects to a dead page
• Status: Dead — domain doesn't resolve

What to do:

1. Remove them from your provider config to avoid timeout delays:

# ~/.config/subfinder/provider-config.yaml
# Just don't include bufferover or redhuntlabs sections

2. Free alternatives that actually work right now:

   • SecurityTrails — free tier with API key
   • Shodan — free API key gives basic subdomain data
   • FullHunt — free tier available
   • Chaos (ProjectDiscovery) — free for researchers
   • CertSpotter — no API key needed
   • HackerTarget — free tier
   • AlienVault OTX — free API key

3. Check which sources are actually returning results for you:

subfinder -d example.com -sources bufferover,redhuntlabs -v

This will show you the errors from each source. ProjectDiscovery should probably mark these as deprecated in the default config.