6

I found several websites offer a function that allows you to list all domains hosted on the same machine, e.g you supply a.com, and it tells you b.com and c.com are both hosted on the same machine as a.com.

How did they know about it?

My first thought was to do a DNS lookup on a.com, find its IP, and a reverse IP look up on all these IPs to see if any domain matches.

In this case, that process is expected to be slow, But the website returns the result nearly immediately, so they mustn't be using this method.

1
  • You can try reverse lookup. If webserver address is 1.2.3.4 you can try host 1.2.3.4 1.2.3.4 and that could reveal all the websites hosted on that ip, for example ispconfig by default configures reverse DNS, as well many other hosting systems as well windows active directory. Oct 23, 2012 at 18:24

3 Answers 3

3

There is absolutely no way to list all domains "hosted" on a machine as you state it.

First of all, what you wanted to do will only give you the name(s) attached to a PTR record (reverse DNS to an IP). It will not give you a list of A records pointing to it.

What you must understand about DNS, is that they act as a database of associated IP addresses and hostnames. There may be several DNS servers with records pointing (with A records) to a single host. But there is no way to know which servers are effectively hosting those records, as well, as there is no type of DNS query that asks a DNS server for A records pointing to a specific IP.

You stated about websites proposing to "query" about an IP to know which sites are hosted on it. All those sites do, is storing in a database association between public websites (and hostnames) and their attached IP address(es), indexing on the IP. This only works if they can guarantee you that they crowled the entire www, world-wide, and that their informations are accurate, which they can't, as they are thousands of "websites" hosted privately (without search engines indexation and no cross-links), others moving around and changing IP, etc ...

I hope this explaination was clear enough and helped.

1
  • A webhost provider can add all the hostnames in the reverse DNS and make it possible to query the DNS-system for the hostnames on the same IP. This is not done mostly because it needs to be kept updated. And to some degree security by obscurity.
    – Kent
    Oct 22, 2012 at 12:54
2

They make a DNS lookup on each domain name and then make a list on which domain name has the same IP-address. This is saved into a database, so if you search for a "new" domain name it will only do one DNS lookup (for the A record for this domain) and then query their database for all the hosts with that IP address. The list of domain names on on host might not be complete.

1

Our site, https://host.io, is a site that does this, for example https://host.io/facebook.com#shared shows you that fb.com is also hosted on the same IP address.

The way we (and others) create this data is start with a list of domains, and then resolve them all to an IP address. That data is stored to a database, and then you can query it in reverse, so find a list of all domains with a specific IP address.

We do something similar with the backlink data. We scrape the website for all the domains, store the link data, and then we can find all websites that link to a specific domain.

You can do this regularly (we do it once per month) and then track the changes over time, and answer questions like "where was this domain hosted 2 years ago", or "what new domains have started linking to this domain this month".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .