I'm scanning a network (whose name will not be stated). It has >1 IP addresses. When I tried scanning its subdomains, there are several subdomains that are translated to the same IP address but return different scan reports (like different ports being reported).
nmap subdomain1 nmap subdomain2 nmap i.p.v.4 # The IPv4 that both subdomains translate to nmap subdomain1 -A -p- nmap subdomain2 -A -p- nmap i.p.v.4 -A -p- # This also returns different results
Those 3 all return different port findings.
From what I know, the URL/domain name should just be translated to the IP then scan, so I think they should all return the same results.
Why are different results returned? Is it because of domain translation (something I missed?) or is it something else?
Also, if given an IP address of a domain and its subdomains with the same IP, should I just scan the IP (save time and resources) or should I also scan every subdomain?