When I try to find websites hosted on a specific IP using one of the online Reverse IP Lookup tools, I only get one website, but when I use Sub-domain enumeration, I find several websites on the same IP Why does this happen? And how can I find all the websites on a particular IP?
Reverse IP Lookup usually returns the domains under the primary Top Level Domains hosted on a given IP address (since that is what is usually placed in the PTR record), not a complete list of websites hosted at the IP. This typically does not include sub-domains since the subdomains are not directly under the primary top level domains.
And how can I find all the websites on a particular IP?
If you want to enumerate all websites including sub-domains, you can try using a reverse IP lookup to find the domains hosted on that IP and then enumerate sub-domains for all of them.