nmap: Same IP, different domain names, different results?

Question

I'm scanning a network (whose name will not be stated). It has >1 IP addresses. When I tried scanning its subdomains, there are several subdomains that are translated to the same IP address but return different scan reports (like different ports being reported).

For example:

nmap subdomain1
nmap subdomain2
nmap i.p.v.4
# The IPv4 that both subdomains translate to

nmap subdomain1 -A -p-
nmap subdomain2 -A -p-
nmap i.p.v.4 -A -p-
# This also returns different results

Those 3 all return different port findings.

From what I know, the URL/domain name should just be translated to the IP then scan, so I think they should all return the same results.

Why are different results returned? Is it because of domain translation (something I missed?) or is it something else?

Also, if given an IP address of a domain and its subdomains with the same IP, should I just scan the IP (save time and resources) or should I also scan every subdomain?

Answer 1

There might be a Web Application Firewall with different profiles for different domains. So they might share the same ip address but every domain serves a different purpose and so different ports are allowed. A WAF is able to "unterstandt" the http packets, that way it is able to determine the domain you try to connect to.