Say you had multiple domain names mapped to a single IP address. How
might one go about getting a list of these domain names?

Here's an example of a website that does it:

http://www.domaintools.com/reverse-i...asshosting.com

I'm just not sure how it's done...

On Sat, 21 Oct 2006 23:27:40 -0700, yawnmoth wrote:

> Say you had multiple domain names mapped to a single IP address. How
> might one go about getting a list of these domain names?
>
> Here's an example of a website that does it:
>
> http://www.domaintools.com/reverse-i...asshosting.com
>
> I'm just not sure how it's done...

First, reverse DNS matching forward DNS is just a convention, one that is
very often broken.

Secondly, there is nothing wrong with multiple PTR records on one IP
address.

So if the reverse DNS is set up so that all domain names have a reverse,
the task is simple. Otherwise, it is impossible.

HTH,
M4
--
Redundancy is a great way to introduce more single points of failure.

Martijn Lievaart wrote:
> On Sat, 21 Oct 2006 23:27:40 -0700, yawnmoth wrote:
>
> > Say you had multiple domain names mapped to a single IP address. How
> > might one go about getting a list of these domain names?
> >
> > Here's an example of a website that does it:
> >
> > http://www.domaintools.com/reverse-i...asshosting.com
> >
> > I'm just not sure how it's done...
>
> First, reverse DNS matching forward DNS is just a convention, one that is
> very often broken.
>
> Secondly, there is nothing wrong with multiple PTR records on one IP
> address.
I guess that'd be how the above URL is getting multiple domain names
for a single IP address. This begs the question... how might I do the
same thing with some command line tools in either Linux or Windows?

In article <1161567061.025681.223550@m73g2000cwd.googlegroups .com>,
"yawnmoth" <terra1024@yahoo.com> wrote:

> Martijn Lievaart wrote:
> > On Sat, 21 Oct 2006 23:27:40 -0700, yawnmoth wrote:
> >
> > > Say you had multiple domain names mapped to a single IP address. How
> > > might one go about getting a list of these domain names?
> > >
> > > Here's an example of a website that does it:
> > >
> > > http://www.domaintools.com/reverse-i...asshosting.com
> > >
> > > I'm just not sure how it's done...
> >
> > First, reverse DNS matching forward DNS is just a convention, one that is
> > very often broken.
> >
> > Secondly, there is nothing wrong with multiple PTR records on one IP
> > address.
> I guess that'd be how the above URL is getting multiple domain names
> for a single IP address. This begs the question... how might I do the
> same thing with some command line tools in either Linux or Windows?

nslookup <ip-address>

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***

Barry Margolin wrote:
> In article <1161567061.025681.223550@m73g2000cwd.googlegroups .com>,
> "yawnmoth" <terra1024@yahoo.com> wrote:
>
> > Martijn Lievaart wrote:
> > > On Sat, 21 Oct 2006 23:27:40 -0700, yawnmoth wrote:
> > >
> > > > Say you had multiple domain names mapped to a single IP address. How
> > > > might one go about getting a list of these domain names?
> > > >
> > > > Here's an example of a website that does it:
> > > >
> > > > http://www.domaintools.com/reverse-i...asshosting.com
> > > >
> > > > I'm just not sure how it's done...
> > >
> > > First, reverse DNS matching forward DNS is just a convention, one that is
> > > very often broken.
> > >
> > > Secondly, there is nothing wrong with multiple PTR records on one IP
> > > address.
> > I guess that'd be how the above URL is getting multiple domain names
> > for a single IP address. This begs the question... how might I do the
> > same thing with some command line tools in either Linux or Windows?
>
> nslookup <ip-address>
nslookup only returns 1 domain name - not the ~80 domain names that
domaintools.com returns...

yawnmoth wrote:

> Say you had multiple domain names mapped to a single IP address. How
> might one go about getting a list of these domain names?
>
> Here's an example of a website that does it:
>
> http://www.domaintools.com/reverse-i...asshosting.com
>
> I'm just not sure how it's done...

That link required registration, so there's no way I can figure out
what you're talking about. Why not post an example question and the
answers you get?

DS

In article <1161581443.837355.277410@f16g2000cwb.googlegroups .com>,
"yawnmoth" <terra1024@yahoo.com> wrote:

> Barry Margolin wrote:
> > In article <1161567061.025681.223550@m73g2000cwd.googlegroups .com>,
> > "yawnmoth" <terra1024@yahoo.com> wrote:
> >
> > > Martijn Lievaart wrote:
> > > > On Sat, 21 Oct 2006 23:27:40 -0700, yawnmoth wrote:
> > > >
> > > > > Say you had multiple domain names mapped to a single IP address. How
> > > > > might one go about getting a list of these domain names?
> > > > >
> > > > > Here's an example of a website that does it:
> > > > >
> > > > > http://www.domaintools.com/reverse-i...passhosting.co
> > > > > m
> > > > >
> > > > > I'm just not sure how it's done...
> > > >
> > > > First, reverse DNS matching forward DNS is just a convention, one that
> > > > is
> > > > very often broken.
> > > >
> > > > Secondly, there is nothing wrong with multiple PTR records on one IP
> > > > address.
> > > I guess that'd be how the above URL is getting multiple domain names
> > > for a single IP address. This begs the question... how might I do the
> > > same thing with some command line tools in either Linux or Windows?
> >
> > nslookup <ip-address>
> nslookup only returns 1 domain name - not the ~80 domain names that
> domaintools.com returns...

I don't think so. If there are multiple PTR records, I believe nslookup
will show them all.

Can you give an example of an address that domaintools.com gives
multiple IPs for? If you're talking about 72.29.74.47 (the address of
melo.surpasshosting.com) then they're *not* using reverse DNS to do it
(that address only has one PTR record), they're using some other trick.

One way to do it would be to operate a caching DNS server with logging
enabled. Then periodically scan the logs, looking for all the returned
records, and build up a database. So if someone looks up
www.example.com and www.otherexample.com, and they both resolve to
1.2.3.4, it puts both these records in its database.

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***

On Mon, 23 Oct 2006 21:05:46 -0400, Barry Margolin
<barmar@alum.mit.edu> wrote:

>In article <1161581443.837355.277410@f16g2000cwb.googlegroups .com>,
> "yawnmoth" <terra1024@yahoo.com> wrote:
>
>> Barry Margolin wrote:
>> > In article <1161567061.025681.223550@m73g2000cwd.googlegroups .com>,
>> > "yawnmoth" <terra1024@yahoo.com> wrote:
>> >
>> > > Martijn Lievaart wrote:
>> > > > On Sat, 21 Oct 2006 23:27:40 -0700, yawnmoth wrote:
>> > > >
>> > > > > Say you had multiple domain names mapped to a single IP address. How
>> > > > > might one go about getting a list of these domain names?
>> > > > >
>> > > > > Here's an example of a website that does it:
>> > > > >
>> > > > > http://www.domaintools.com/reverse-i...passhosting.co
>> > > > > m
>> > > > >
>> > > > > I'm just not sure how it's done...

> they're using some other trick.
>
>One way to do it would be to operate a caching DNS server with logging
>enabled.

It must be some kind of logging. I ran their service against 2
servers that hosts some of my sites.
Both produced a 100+ domains answer with all my sites missing :-)

--
Kind regards,
Gerard Bok