For example, given the range: -

I need to find some domain that resolves to an IP-adress within the range. Is it possible ? I'm using a Linux system.


Well, the DiG utility (man dig) can do reverse-DNS lookups to see if a given IP address has an associated DNS record. AFAIK it only accepts a single address at a time, but you could use some bash looping to generate the commands to check all the addresses.

for i in $(seq 128 191) ; do 
  for j in $(seq 1 255) ; do
    for k in $(seq 1 255) ; do
      dig -x 172.$i.$j.$k
      sleep 5

In one line:

for i in $(seq 128 191) ; do for j in $(seq 1 255) ; do for k in $(seq 1 255) ; do dig -x 172.$i.$j.$k ; sleep 5 ; done ; done ; done

You might want the +short option (or other options) to help get the output into some meaningful form. See man dig for possible options; here's the syntax:

dig +short -x 172.$i.$j.$k
| improve this answer | |
  • 1
    note this doesn't (to my knowledge) find all possible DNS records, just some DNS record, if it exists. – quack quixote Feb 12 '10 at 22:33
  • 1
    This should do it. (You might want to put a delay in there as well to avoid hammering your DNS server) – mpeterson Feb 13 '10 at 1:17
  • good tip. i meant to point that out explicitly but managed to forget. any additional processing desired can be added; add into the innermost loop if that step is wanted per-address. – quack quixote Feb 13 '10 at 1:34

There are sites which offer what is known as passive DNS lookup. They build up a database by monitoring DNS traffic, and keep track of the results.

Normally, DNS lookups only provide limited IP to hostname lookup services. If the owner of the IP space bothered to set up reverse DNS (rDNS) it can tell you that there is one mapping from to a single host name, but this is not necessarily the whole truth, or even the truth at all. In practice, it is quite unremarkable for there to be no reverse DNS information, or for it to give you a result which does not match the corresponding forward DNS information. And typically, a web hosting service will have hundreds or thousands of web sites living at the same IP address; there is no regular way to find out what they are from the DNS, given the IP address as input.

(Reverse DNS is what the answer with the dig code will get you.)

Passive DNS looks at the results from DNS queries, typically by living on a high-traffic DNS server and observing the results it obtains. So if somebody -- who is being tracked by this service somehow -- looks up wild.example.com and obtains an IP address as a result, the result is stored in a database of mappings from IP addresses to hostnames, which can subsequently be queried.

See e.g. http://www.bfk.de/bfk_dnslogger.html and/or https://www.dnsdb.info/

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.