The dictionary

Every scan you run accrues to a per-account dictionary of subdomain labels. The dictionary is what makes subpoof's probe step smarter over time - labels you have already seen are tried first on future scans.

What the dictionary tracks

For each unique label (e.g. autodiscover, vpn, dc1), the dictionary records:

• The list of root domains where that label was found
• First-seen and last-seen dates
• A count of how often the label has accrued
• An optional "AD/O365 category" tag (the platform recognizes labels that look like Active Directory or Microsoft 365 infrastructure and tags them automatically)

The dictionary page

The /dictionary view in the dashboard ranks labels by how widely they appear (the count of distinct root domains where the label was seen, descending). The label that shows up on the most roots is at the top.

You can filter by:

• Search: regex match on the label
• Domain: only labels seen on a specific root
• Category: AD / Exchange / Azure / Federation tags
• Watching: pinned labels (see below)

Pinning labels

Each row has a "Pin" button. Pinning a label is global to your account - pinned labels show up under the "Watching" filter and are easier to find later. Pinning does not by itself create an alert; see watches for that.

Adding a watch from a label

The dictionary's "Watch" button creates a label watch (see watches) that fires daily when a new domain adopts the watched label.

Why the dictionary matters

The dictionary feeds back into scans through the dict-probe step. Labels you have seen tend to show up again across new organizations, so the platform tries them first on every new scan. Over time the dictionary becomes a tuned wordlist that reflects the kinds of orgs you scan.

CSV export

The dictionary view has an "Export CSV" link in the toolbar. The export honors the active filter and writes the same fields the dashboard shows.