Getting a list of domains for a given IP address? How?

[BigMike]

The power whois lookup service at:

http://whois.webhosting.info/

can provide a list of domains on a given IP address.

for example: http://whois.webhosting.info/64.4.20.174



Who do they do that?

Thanks,

Mike

[ZYV]

Depends on the accuracy that you want to achieve.

For once, you can just do reverse lookups and if the PTR records are set up correctly here goes your list.

Also, some misconfigured Apache servers would give you an error message if you do an HTTP/1.0 request with a random vhost ServerName in the footer. This way you can enumerate all hosted domains after some trying.

Finally, you can just download the zone files from the root servers and recursively resolve all of the domains in them. Takes some effort, but works flawlessly.