I'm scanning a network (whose name will not be stated). It has >1 IP addresses. When I tried scanning its subdomains, there are several subdomains that are translated to the same IP address but return different scan reports (like different ports being reported).

For example:

nmap subdomain1
nmap subdomain2
nmap i.p.v.4
# The IPv4 that both subdomains translate to

nmap subdomain1 -A -p-
nmap subdomain2 -A -p-
nmap i.p.v.4 -A -p-
# This also returns different results

Those 3 all return different port findings.

From what I know, the URL/domain name should just be translated to the IP then scan, so I think they should all return the same results.

Why are different results returned? Is it because of domain translation (something I missed?) or is it something else?

Also, if given an IP address of a domain and its subdomains with the same IP, should I just scan the IP (save time and resources) or should I also scan every subdomain?

1 Answer 1


There might be a Web Application Firewall with different profiles for different domains. So they might share the same ip address but every domain serves a different purpose and so different ports are allowed. A WAF is able to "unterstandt" the http packets, that way it is able to determine the domain you try to connect to.

  • From what I understand, directly spanning the IP should get me information on ALL the subdomains without having to scan them all one by one. Is that correct? Oct 12, 2019 at 5:49
  • In a simpler Environment You are right
    – Kingflomb
    Oct 12, 2019 at 6:58
  • but if you check only the ip some ports will not respond, but they would If you use the Domain. Thats because the content of your requests is validatet before a decision is made to respond
    – Kingflomb
    Oct 12, 2019 at 7:00
  • Is there some way to probe those ports without having to repeat the scan on all the subdomains? Does nmap i.p.v.4 -A -p- not work in that case? Oct 12, 2019 at 10:11
  • I am Not sure maybe one of the nmap scripts can help
    – Kingflomb
    Oct 12, 2019 at 12:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .