I'm scanning a network (whose name will not be stated). It has >1 IP addresses. When I tried scanning its subdomains, there are several subdomains that are translated to the same IP address but return different scan reports (like different ports being reported).
For example:
nmap subdomain1
nmap subdomain2
nmap i.p.v.4
# The IPv4 that both subdomains translate to
nmap subdomain1 -A -p-
nmap subdomain2 -A -p-
nmap i.p.v.4 -A -p-
# This also returns different results
Those 3 all return different port findings.
From what I know, the URL/domain name should just be translated to the IP then scan, so I think they should all return the same results.
Why are different results returned? Is it because of domain translation (something I missed?) or is it something else?
Also, if given an IP address of a domain and its subdomains with the same IP, should I just scan the IP (save time and resources) or should I also scan every subdomain?