AMASS will enumerate blacklisted domains in v5.0.1
Author: PurpleLinuxCreated Feb 6, 2026Updated Feb 6, 2026
In the documentation here: https://owasp-amass.github.io/docs/configuration/
It discusses blacklisting. If you seed with owasp.org, and blacklist subdom.owasp.org, the blacklist should filter that subdomain and not feed it back into the database or the engine. However, the domain subdom.owasp.org will be added to the db and enumerated.
scope:
domains:
- owasp.org
ips:
- 192.0.2.1
- 192.168.0.10-192.168.0.20
cidrs:
- 192.0.2.0/24
ports:
- 80
- 443
blacklist:
- test.owasp.orgThe above config will lead to test.owasp.org (replace with real subdomain you want to filter) to being in the output.
Source: owasp-amass/amass