When I try to find websites hosted on a specific IP using one of the online Reverse IP Lookup tools, I only get one website, but when I use Sub-domain enumeration, I find several websites on the same IP Why does this happen? And how can I find all the websites on a particular IP?


1 Answer 1


Reverse IP Lookup usually returns the domains under the primary Top Level Domains hosted on a given IP address (since that is what is usually placed in the PTR record), not a complete list of websites hosted at the IP. This typically does not include sub-domains since the subdomains are not directly under the primary top level domains.

And how can I find all the websites on a particular IP?

If you want to enumerate all websites including sub-domains, you can try using a reverse IP lookup to find the domains hosted on that IP and then enumerate sub-domains for all of them.

  • Is there a command line in windows for reverse IP lookup? Example @nobody
    – alex
    Aug 29, 2020 at 11:32
  • @alex serverfault.com/questions/41064/…
    – nobody
    Aug 29, 2020 at 11:42
  • I still get the same problem when I use nslookup I get only one website hosted on IP but when I use this service pentest-tools.com/information-gathering/… I get many website hosted on the same IP
    – alex
    Aug 29, 2020 at 11:51
  • @alex That site does sub-domain enumeration. Reverse IP lookup and subdomain enumeration are separate things. Reverse IP uses DNS PTR records, while subdomain enumeration uses many different techniques
    – nobody
    Aug 29, 2020 at 11:57

Not the answer you're looking for? Browse other questions tagged .