Some online security checking tools have a database of DNS names linked to an IP.
For example on https://www.ssllabs.com when I request stackoverflow.com
(151.101.129.69), the result contains :
Alternative names: *.stackexchange.com stackoverflow.com *.stackoverflow.com stackauth.com sstatic.net *.sstatic.net serverfault.com *.serverfault.com superuser.com *.superuser.com stackapps.com openid.stackauth.com stackexchange.com *.meta.stackexchange.com meta.stackexchange.com mathoverflow.net *.mathoverflow.net askubuntu.com *.askubuntu.com stacksnippets.net *.blogoverflow.com blogoverflow.com *.meta.stackoverflow.com *.stackoverflow.email stackoverflow.email
see : https://www.ssllabs.com/ssltest/analyze.html?d=stackoverflow.com&s=151.101.129.69&hideResults=on
To my understanding of how DNS works, it's impossible to request all names related to an IP address if domain is locked for transfer :
$ dig stackoverflow.com any
[..]
;stackoverflow.com. IN ANY
;; ANSWER SECTION:
stackoverflow.com. 1800 IN A 151.101.193.69
stackoverflow.com. 1800 IN A 151.101.129.69
stackoverflow.com. 1800 IN A 151.101.65.69
stackoverflow.com. 1800 IN A 151.101.1.69
stackoverflow.com. 9900 IN SOA ns-cloud-e1.googledomains.com. cloud-dns-hostmaster.google.com. 1 21600 3600 259200 300
[..]
And reverse lookup on ip address will returns only one record (or none) :
$ host 151.101.129.69
Host 69.129.101.151.in-addr.arpa. not found: 3(NXDOMAIN)
So my question is, how can be built a database that contains 'alternatives names' of an ip address ?