How can this tool find out registered domains from an IP?Finding all domains registered in a nameserverDYNDNS.org Custom DNS returning odd results with Windows' NSLOOKUPDNS Issue when trying to promote a server to a DCMoved DNS and Email Hosting, Now Can't Send/Receive To/From Domains Hosted on Previous HostLaptops on Windows Domain sometimes have problems accessing internet when off-siteNetwork DNS Issues Complicated by Amazon EC2 DNS CNAMEHow to include multiple domains in an spf TXT Recorddedicated rpd server unable to resolve domain names2003 joining domain “The specified network name is unavailable”Google Domains: Registered hosts vs Custom Records
Arriving at the same result with the opposite hypotheses
Motivation - or how can I get myself to do the work I know I need to?
How to forge a multi-part weapon?
What do abbreviations in movie scripts stand for?
An average heaven where everyone has sexless golden bodies and is bored
Are there any important biographies of nobodies?
Is it possible to 'live off the sea'
Does an ice chest packed full of frozen food need ice?
Do simulator games use a realistic trajectory to get into orbit?
Trapping Rain Water
Are there any instruments that don't produce overtones?
A planet of ice and fire
Confusion around using "des" in sentences
Were Alexander the Great and Hephaestion lovers?
Why did the Tesseract "burn" a hole through Red Skull's plane but not Nick Fury's desk?
How can I tell the difference between unmarked sugar and stevia?
How to tell your grandparent to not come to fetch you with their car?
Cycle through MeshStyle directives in ListLinePlot
Universal hash functions with homomorphic XOR property
What language is software running on the ISS written in?
Grover algorithm for a database search: where is the quantum advantage?
Where Mongol herds graze
Taxi Services at Didcot
Can I make plugins required?
How can this tool find out registered domains from an IP?
Finding all domains registered in a nameserverDYNDNS.org Custom DNS returning odd results with Windows' NSLOOKUPDNS Issue when trying to promote a server to a DCMoved DNS and Email Hosting, Now Can't Send/Receive To/From Domains Hosted on Previous HostLaptops on Windows Domain sometimes have problems accessing internet when off-siteNetwork DNS Issues Complicated by Amazon EC2 DNS CNAMEHow to include multiple domains in an spf TXT Recorddedicated rpd server unable to resolve domain names2003 joining domain “The specified network name is unavailable”Google Domains: Registered hosts vs Custom Records
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
This is one that I've never really known how to do, it's been nagging me from time to time for years. I've read all I could find, including all the answers here. None of them gives a real answer to the question. So please read carefully before flagging a duplicate; it is not.
dig, host, nslookup... none of them seems to be able to get what I'm after.
At most I can get pointers like ec2-xxx-xxx-xxx-xxx.us-east-2.compute.amazonaws.com.
But if I use this online tool, I get exactly what I'm looking for: every domain that resolves to the IP given (or a hostname). In this case, it's a freemium service so it'll only list the first few, but it works. In the following image, I use 3 domains that I own and serve from a VPS. They are totally unrelated, but they all appear here:

What black magic are they using? How can we replicate it?
domain-name-system hostname reverse-dns
add a comment |
This is one that I've never really known how to do, it's been nagging me from time to time for years. I've read all I could find, including all the answers here. None of them gives a real answer to the question. So please read carefully before flagging a duplicate; it is not.
dig, host, nslookup... none of them seems to be able to get what I'm after.
At most I can get pointers like ec2-xxx-xxx-xxx-xxx.us-east-2.compute.amazonaws.com.
But if I use this online tool, I get exactly what I'm looking for: every domain that resolves to the IP given (or a hostname). In this case, it's a freemium service so it'll only list the first few, but it works. In the following image, I use 3 domains that I own and serve from a VPS. They are totally unrelated, but they all appear here:

What black magic are they using? How can we replicate it?
domain-name-system hostname reverse-dns
add a comment |
This is one that I've never really known how to do, it's been nagging me from time to time for years. I've read all I could find, including all the answers here. None of them gives a real answer to the question. So please read carefully before flagging a duplicate; it is not.
dig, host, nslookup... none of them seems to be able to get what I'm after.
At most I can get pointers like ec2-xxx-xxx-xxx-xxx.us-east-2.compute.amazonaws.com.
But if I use this online tool, I get exactly what I'm looking for: every domain that resolves to the IP given (or a hostname). In this case, it's a freemium service so it'll only list the first few, but it works. In the following image, I use 3 domains that I own and serve from a VPS. They are totally unrelated, but they all appear here:

What black magic are they using? How can we replicate it?
domain-name-system hostname reverse-dns
This is one that I've never really known how to do, it's been nagging me from time to time for years. I've read all I could find, including all the answers here. None of them gives a real answer to the question. So please read carefully before flagging a duplicate; it is not.
dig, host, nslookup... none of them seems to be able to get what I'm after.
At most I can get pointers like ec2-xxx-xxx-xxx-xxx.us-east-2.compute.amazonaws.com.
But if I use this online tool, I get exactly what I'm looking for: every domain that resolves to the IP given (or a hostname). In this case, it's a freemium service so it'll only list the first few, but it works. In the following image, I use 3 domains that I own and serve from a VPS. They are totally unrelated, but they all appear here:

What black magic are they using? How can we replicate it?
domain-name-system hostname reverse-dns
domain-name-system hostname reverse-dns
edited 3 hours ago
Carles Alcolea
asked 8 hours ago
Carles AlcoleaCarles Alcolea
1086
1086
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
It's brute force.
They have looked up the IP addresses of every domain name they can find, and then compiled the results into their own database.
OMG. That was unexpected. Thanks.
– Carles Alcolea
3 hours ago
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f970089%2fhow-can-this-tool-find-out-registered-domains-from-an-ip%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
It's brute force.
They have looked up the IP addresses of every domain name they can find, and then compiled the results into their own database.
OMG. That was unexpected. Thanks.
– Carles Alcolea
3 hours ago
add a comment |
It's brute force.
They have looked up the IP addresses of every domain name they can find, and then compiled the results into their own database.
OMG. That was unexpected. Thanks.
– Carles Alcolea
3 hours ago
add a comment |
It's brute force.
They have looked up the IP addresses of every domain name they can find, and then compiled the results into their own database.
It's brute force.
They have looked up the IP addresses of every domain name they can find, and then compiled the results into their own database.
answered 8 hours ago
Michael Hampton♦Michael Hampton
179k27326660
179k27326660
OMG. That was unexpected. Thanks.
– Carles Alcolea
3 hours ago
add a comment |
OMG. That was unexpected. Thanks.
– Carles Alcolea
3 hours ago
OMG. That was unexpected. Thanks.
– Carles Alcolea
3 hours ago
OMG. That was unexpected. Thanks.
– Carles Alcolea
3 hours ago
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f970089%2fhow-can-this-tool-find-out-registered-domains-from-an-ip%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown