For example, given the range:
18.104.22.168 - 22.214.171.124
I need to find some domain that resolves to an IP-adress within the range. Is it possible ? I'm using a Linux system.
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
Well, the DiG utility (
man dig) can do reverse-DNS lookups to see if a given IP address has an associated DNS record. AFAIK it only accepts a single address at a time, but you could use some bash looping to generate the commands to check all the addresses.
for i in $(seq 128 191) ; do for j in $(seq 1 255) ; do for k in $(seq 1 255) ; do dig -x 172.$i.$j.$k sleep 5 done done done
In one line:
for i in $(seq 128 191) ; do for j in $(seq 1 255) ; do for k in $(seq 1 255) ; do dig -x 172.$i.$j.$k ; sleep 5 ; done ; done ; done
You might want the
+short option (or other options) to help get the output into some meaningful form. See
man dig for possible options; here's the syntax:
dig +short -x 172.$i.$j.$k
There are sites which offer what is known as passive DNS lookup. They build up a database by monitoring DNS traffic, and keep track of the results.
Normally, DNS lookups only provide limited IP to hostname lookup services. If the owner of the IP space bothered to set up reverse DNS (rDNS) it can tell you that there is one mapping from
126.96.36.199.in-addr.arpa to a single host name, but this is not necessarily the whole truth, or even the truth at all. In practice, it is quite unremarkable for there to be no reverse DNS information, or for it to give you a result which does not match the corresponding forward DNS information. And typically, a web hosting service will have hundreds or thousands of web sites living at the same IP address; there is no regular way to find out what they are from the DNS, given the IP address as input.
(Reverse DNS is what the answer with the
dig code will get you.)
Passive DNS looks at the results from DNS queries, typically by living on a high-traffic DNS server and observing the results it obtains. So if somebody -- who is being tracked by this service somehow -- looks up
wild.example.com and obtains an IP address as a result, the result is stored in a database of mappings from IP addresses to hostnames, which can subsequently be queried.