How I can find the hosted websites behind an IP using purely the Linux/Unix command line? In the age of shared hosting, it seems to occur quite often that multiple websites are hosted on the same IP. And I'm looking to find a 100% command line solution.

My only working solution requires using the browser and the command line.

  1. dig +short hostname
  2. Then copying the IP address of the result into the browser and running either a Yahoo or Bing query with ip:theip...

This will return all the websites hosted under that IP. However, I would like to rely purely on the command line. Does anyone have any suggestions?

  • dig -x ipaddress? – DavidPostill Mar 18 '17 at 23:09
  • 1
    You do understand that DNS names are not necessarily associated with web sites at all, right? you can dump the DNS names associated with teh IP, but they may or may not translate to sites, and will only show you sites that are registered in public DNS. There is no universal means to do exactly what you request. Tools like NMAP would get you closest, but even then most webservers implement hostname linkages based technology that allows them to host multiple sites/certificates on a single IP:port. – Frank Thomas Mar 18 '17 at 23:15
  • @DavidPostill Unfortunately that does not give back the right answer. It just does a simple reverse lookup. – Julius Mar 18 '17 at 23:20
  • @FrankThomas I do understand that not all DNS names need necessarily be associated with websites. I guess I am interested in sites that are registered on public DNS. From what I understand, the easiest way might be to script the search engine in curl and then parse it in order to extract the links. Would you agree? – Julius Mar 18 '17 at 23:25
  • This sounds like a job for a web crawler. – music2myear Mar 21 '17 at 0:06

You cant do this with any accuracy without relying on a third party system which has the resources to create this database.

There is no way to force/ask a web server to divulge the domains it hosts without special access to it. Google, Bing etc are in a position where they see lots of sites and can build these databases.

Unless you find a system with some kind of API and purchase access you cant get the info you are seeking - ie its not available from the server and there is no single authority you can query through dns.

  • I agree, but I disagree partially as well. So yes, my method works because I rely on an external database which I can query on the basis of IPs (which is an advantage and also the reason why it doesn't work on Google). However, I imagine there to be a way without relying on an external database: You could brute-query the server with different HTTP GET requests (each time varying the queried domain) and noting the answer. Wouldn't that be a possibility? The risk being, of course, that this might be taken as a DoS attack. – Julius Mar 19 '17 at 19:31
  • 1
    You can not practically brute-query the with http get requests - as long as there are well over a 300 million domains spread across many registries (excluding subdomains), without a single central list of all the domain names, most of which do not have a list of all the domain names. ( I note that querying the server for HTTP requests would be a dumb away of doing it as the bulk of the answer is in DNS servers which are more scalable and easier to query, but still not feasible ) – davidgo Mar 19 '17 at 20:14
  • Hmm. So I guess I have to dig deeper into how DNS works. But sites like robtex.com/ip seem to be able to return you with several different hostnames depending on the IP queried. How does it work in their case? I have read their description but haven't completely understood how they are able to do it. – Julius Mar 19 '17 at 22:42
  • The robtex.comp link you provided talks about REVERSE DNS - this takes an IP address and associates it with a (single) domain name - not all the domain names for the site. FWIW, while robtex does pick up some information, the information it holds about sites on my web servers is neither up to date nor anywhere near complete. – davidgo Mar 19 '17 at 23:20

Good luck. Here, try mine.

The URL is http://calttc.net Same file system is pointed to by http://calttc.com

There is a login test at /login.htm that simply links to a PHP file that echoes whatever you type in.

So, try to work this backwards:

First, use ping or nmap from the command line to get the IP address.

Now use nmap (or any other tool) with the IP address and see if you can find any way to get my URL given just the IP address.

In fact, I doubt you can even find out my service provider nor even my name server provider.

And I am not even particularly trying to hide it.

  • @Frank gave you the best info - it would have made a good answer. So give this a try his hint and my test site. (My real content for these addresses are in subdirectories, by the way) – SDsolar Mar 19 '17 at 3:55
  • 1
    I get your point. I have been able to work backwards using the method I described earlier (seems you are hosting on Bluehost). But yes, that's about it. – Julius Mar 19 '17 at 19:25
  • Score one for you finding Bluehost. Was it just one or was it both URL's, or the IP that allowed you to find that info? What tool did you use? And did you find the name servers? – SDsolar Mar 19 '17 at 21:53
  • I don't exactly remember, but I think it was just using the host command. If I use the IP of your server and plug it into this site, it hands out tons of information: robtex.com/ip-lookup/ ns1 and ns2.bluehost.com are your nameservers. And it's even possible to see all the other domains associated with the IP. And no, I just used the .net domain. – Julius Mar 19 '17 at 22:47
  • What you caught were the default name servers for most domains on that server. I use external name servers. Still, good show unmasking the hosting service. – SDsolar Mar 20 '17 at 0:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.