How can this tool find out registered domains from an IP address?DYNDNS.org Custom DNS returning odd results with Windows' NSLOOKUPDNS Issue when trying to promote a server to a DCLaptops on Windows Domain sometimes have problems accessing internet when off-siteslow DNS resolutionNetwork DNS Issues Complicated by Amazon EC2 DNS CNAMEdedicated rpd server unable to resolve domain namesHow can nslookup on an IP address return NXDOMAIN but I can still ping it?Moving DNS to a new provider; their servers don't respond but they say it's OK?
Are the Shimano derailleurs sold on Ali Express genuine or fake?
Why are my plastic credit card and activation code sent separately?
Replacing triangulated categories with something better
How does a manufacturer determine the warranty for the battery?
Uncountably many functions coinciding only finitely many values
Is Dom based XSS still a valid security concern in modern browsers?
Are there any spells that aren't on any class's spell list?
What are the targeting range limitations of Glyph of Warding?
Yarok and Animate Dead
What are some examples of three-mora atamadaka verbs besides 帰る?
Leaving car in Lubbock, Texas for 1 month
Non-differentiable Lipschitz functions
18-month-old kicked out of church nursery
How can I determine if two vertices on a polygon are consecutive?
What's the meaning of "uao"?
Radar Altimeter in Space Shuttle
What is the autocorrelation of a Dirac pulse?
Right way to say I disagree with the design but ok I will do
Impeachment jury tampering
Computationally expensive AI techniques (that are promising)
Dungeon of the Mad Mage room ceiling height?
How do I build a kernel using patches from LKML?
Migrate foreign key type from char to binary - ways to deal with the fallout?
Run "cd" command as superuser in Linux
How can this tool find out registered domains from an IP address?
DYNDNS.org Custom DNS returning odd results with Windows' NSLOOKUPDNS Issue when trying to promote a server to a DCLaptops on Windows Domain sometimes have problems accessing internet when off-siteslow DNS resolutionNetwork DNS Issues Complicated by Amazon EC2 DNS CNAMEdedicated rpd server unable to resolve domain namesHow can nslookup on an IP address return NXDOMAIN but I can still ping it?Moving DNS to a new provider; their servers don't respond but they say it's OK?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty
margin-bottom:0;
This is one that I've never really known how to do, and it's been nagging me from time to time for years. I've read all I could find, including all the answers here. None of them gives a real answer to the question. So please read carefully before flagging a duplicate; it is not.
dig, host, nslookup... none of them seems to be able to get what I'm after.
At most I can get pointers like ec2-xxx-xxx-xxx-xxx.us-east-2.compute.amazonaws.com.
But if I use this online tool, I get exactly what I'm looking for: every domain that resolves to the IP address given (or a hostname). In this case, it's a freemium service, so it'll only list the first few, but it works. In the following image, I use three domains that I own and serve from a VPS. They are totally unrelated, but they all appear here:
What black magic are they using? How can we replicate it?
domain-name-system hostname reverse-dns
edited Jun 6 at 8:36
Peter Mortensen
2,1764 gold badges22 silver badges24 bronze badges
asked Jun 4 at 15:17
Carles AlcoleaCarles Alcolea
2132 silver badges8 bronze badges
add a comment
|
This is one that I've never really known how to do, and it's been nagging me from time to time for years. I've read all I could find, including all the answers here. None of them gives a real answer to the question. So please read carefully before flagging a duplicate; it is not.
dig, host, nslookup... none of them seems to be able to get what I'm after.
At most I can get pointers like ec2-xxx-xxx-xxx-xxx.us-east-2.compute.amazonaws.com.
But if I use this online tool, I get exactly what I'm looking for: every domain that resolves to the IP address given (or a hostname). In this case, it's a freemium service, so it'll only list the first few, but it works. In the following image, I use three domains that I own and serve from a VPS. They are totally unrelated, but they all appear here:
What black magic are they using? How can we replicate it?
domain-name-system hostname reverse-dns
edited Jun 6 at 8:36
Peter Mortensen
2,1764 gold badges22 silver badges24 bronze badges
asked Jun 4 at 15:17
Carles AlcoleaCarles Alcolea
2132 silver badges8 bronze badges
Noted it doesn't work at all on IPv6 - too much data to index. And it also misses things that don't start in www.
– Criggie
Jun 5 at 1:07
@Criggie: That's probably not the reason. If they are not using rDNS, but just bruteforcing regular domain→IP records as Michael said, then the number of "possible" addresses cannot actually affect the process in any way. (After all, why would they index and store addresses which have no domains?) More likely they just didn't bother.
– grawity
Jun 5 at 9:02
add a comment
|
This is one that I've never really known how to do, and it's been nagging me from time to time for years. I've read all I could find, including all the answers here. None of them gives a real answer to the question. So please read carefully before flagging a duplicate; it is not.
dig, host, nslookup... none of them seems to be able to get what I'm after.
At most I can get pointers like ec2-xxx-xxx-xxx-xxx.us-east-2.compute.amazonaws.com.
But if I use this online tool, I get exactly what I'm looking for: every domain that resolves to the IP address given (or a hostname). In this case, it's a freemium service, so it'll only list the first few, but it works. In the following image, I use three domains that I own and serve from a VPS. They are totally unrelated, but they all appear here:
What black magic are they using? How can we replicate it?
domain-name-system hostname reverse-dns
edited Jun 6 at 8:36
Peter Mortensen
2,1764 gold badges22 silver badges24 bronze badges
asked Jun 4 at 15:17
Carles AlcoleaCarles Alcolea
2132 silver badges8 bronze badges
This is one that I've never really known how to do, and it's been nagging me from time to time for years. I've read all I could find, including all the answers here. None of them gives a real answer to the question. So please read carefully before flagging a duplicate; it is not.
dig, host, nslookup... none of them seems to be able to get what I'm after.
At most I can get pointers like ec2-xxx-xxx-xxx-xxx.us-east-2.compute.amazonaws.com.
But if I use this online tool, I get exactly what I'm looking for: every domain that resolves to the IP address given (or a hostname). In this case, it's a freemium service, so it'll only list the first few, but it works. In the following image, I use three domains that I own and serve from a VPS. They are totally unrelated, but they all appear here:
What black magic are they using? How can we replicate it?
domain-name-system hostname reverse-dns
domain-name-system hostname reverse-dns
edited Jun 6 at 8:36
Peter Mortensen
2,1764 gold badges22 silver badges24 bronze badges
asked Jun 4 at 15:17
Carles AlcoleaCarles Alcolea
2132 silver badges8 bronze badges
edited Jun 6 at 8:36
Peter Mortensen
2,1764 gold badges22 silver badges24 bronze badges
asked Jun 4 at 15:17
Carles AlcoleaCarles Alcolea
2132 silver badges8 bronze badges
edited Jun 6 at 8:36
Peter Mortensen
2,1764 gold badges22 silver badges24 bronze badges
edited Jun 6 at 8:36
Peter Mortensen
2,1764 gold badges22 silver badges24 bronze badges
edited Jun 6 at 8:36
Peter Mortensen
2,1764 gold badges22 silver badges24 bronze badges
2,1764 gold badges22 silver badges24 bronze badges
asked Jun 4 at 15:17
Carles AlcoleaCarles Alcolea
2132 silver badges8 bronze badges
asked Jun 4 at 15:17
Carles AlcoleaCarles Alcolea
2132 silver badges8 bronze badges
asked Jun 4 at 15:17
Carles AlcoleaCarles Alcolea
2132 silver badges8 bronze badges
2132 silver badges8 bronze badges
Noted it doesn't work at all on IPv6 - too much data to index. And it also misses things that don't start in www.
– Criggie
Jun 5 at 1:07
@Criggie: That's probably not the reason. If they are not using rDNS, but just bruteforcing regular domain→IP records as Michael said, then the number of "possible" addresses cannot actually affect the process in any way. (After all, why would they index and store addresses which have no domains?) More likely they just didn't bother.
– grawity
Jun 5 at 9:02
add a comment
|
Noted it doesn't work at all on IPv6 - too much data to index. And it also misses things that don't start in www.
– Criggie
Jun 5 at 1:07
@Criggie: That's probably not the reason. If they are not using rDNS, but just bruteforcing regular domain→IP records as Michael said, then the number of "possible" addresses cannot actually affect the process in any way. (After all, why would they index and store addresses which have no domains?) More likely they just didn't bother.
– grawity
Jun 5 at 9:02
Noted it doesn't work at all on IPv6 - too much data to index. And it also misses things that don't start in www.
– Criggie
Jun 5 at 1:07
Noted it doesn't work at all on IPv6 - too much data to index. And it also misses things that don't start in www.
– Criggie
Jun 5 at 1:07
@Criggie: That's probably not the reason. If they are not using rDNS, but just bruteforcing regular domain→IP records as Michael said, then the number of "possible" addresses cannot actually affect the process in any way. (After all, why would they index and store addresses which have no domains?) More likely they just didn't bother.
– grawity
Jun 5 at 9:02
@Criggie: That's probably not the reason. If they are not using rDNS, but just bruteforcing regular domain→IP records as Michael said, then the number of "possible" addresses cannot actually affect the process in any way. (After all, why would they index and store addresses which have no domains?) More likely they just didn't bother.
– grawity
Jun 5 at 9:02
add a comment
|
1 Answer
1
active
oldest
votes
It's brute force.
They have looked up the IP addresses of every domain name they can find, and then compiled the results into their own database.
answered Jun 4 at 15:29
Michael Hampton♦Michael Hampton
187k29 gold badges353 silver badges687 bronze badges
3
The only part that is unclear to me is how they find a list of every domain name as there isn't a central list anywhere. Edit: Looks like they don't have everything because my website that has been up for years is not listed
– Qwertie
Jun 5 at 4:38
12
@Qwertie: certificate transparency ledgers are a good place these days – practically everything that has a properly rooted TLS certificate will appear in there.
– Ulrich Schwarz
Jun 5 at 6:18
3
@Qwertie : The Centralized Zone Data Service ( czds.icann.org/en ) could be a good starting point as well - it gives access to a large number of 'zone files' of the various top level domains.
– Richy B.
Jun 5 at 9:43
1
@Qwertie Registrars are exactly a centralized list of all domains... the only issue is that it's not just one of them and also not all of them give easily access to their zone files so access might not be completely free or immediate.
– Giacomo Alzetta
Jun 5 at 12:03
5
@GiacomoAlzetta no, registrars at most have a list of domains they sponsor, not all domains in all TLDs. registries on the contrary obviously have a list of all the domains they maintain, which is available in gTLDs through open access to zonefiles like Richy B. said (but noting that not all registered domain is published so some will be missing). Some others TLDs, like .FR have "open data" initiative where you can get access to many things, including list of domains. Other registries publish daily "newly registered domain names list".
– Patrick Mevzek
Jun 5 at 15:33
|
show 7 more comments
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f970089%2fhow-can-this-tool-find-out-registered-domains-from-an-ip-address%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
It's brute force.
They have looked up the IP addresses of every domain name they can find, and then compiled the results into their own database.
answered Jun 4 at 15:29
Michael Hampton♦Michael Hampton
187k29 gold badges353 silver badges687 bronze badges
3
The only part that is unclear to me is how they find a list of every domain name as there isn't a central list anywhere. Edit: Looks like they don't have everything because my website that has been up for years is not listed
– Qwertie
Jun 5 at 4:38
12
@Qwertie: certificate transparency ledgers are a good place these days – practically everything that has a properly rooted TLS certificate will appear in there.
– Ulrich Schwarz
Jun 5 at 6:18
3
@Qwertie : The Centralized Zone Data Service ( czds.icann.org/en ) could be a good starting point as well - it gives access to a large number of 'zone files' of the various top level domains.
– Richy B.
Jun 5 at 9:43
1
@Qwertie Registrars are exactly a centralized list of all domains... the only issue is that it's not just one of them and also not all of them give easily access to their zone files so access might not be completely free or immediate.
– Giacomo Alzetta
Jun 5 at 12:03
5
@GiacomoAlzetta no, registrars at most have a list of domains they sponsor, not all domains in all TLDs. registries on the contrary obviously have a list of all the domains they maintain, which is available in gTLDs through open access to zonefiles like Richy B. said (but noting that not all registered domain is published so some will be missing). Some others TLDs, like .FR have "open data" initiative where you can get access to many things, including list of domains. Other registries publish daily "newly registered domain names list".
– Patrick Mevzek
Jun 5 at 15:33
|
show 7 more comments
It's brute force.
They have looked up the IP addresses of every domain name they can find, and then compiled the results into their own database.
answered Jun 4 at 15:29
Michael Hampton♦Michael Hampton
187k29 gold badges353 silver badges687 bronze badges
3
The only part that is unclear to me is how they find a list of every domain name as there isn't a central list anywhere. Edit: Looks like they don't have everything because my website that has been up for years is not listed
– Qwertie
Jun 5 at 4:38
12
@Qwertie: certificate transparency ledgers are a good place these days – practically everything that has a properly rooted TLS certificate will appear in there.
– Ulrich Schwarz
Jun 5 at 6:18
3
@Qwertie : The Centralized Zone Data Service ( czds.icann.org/en ) could be a good starting point as well - it gives access to a large number of 'zone files' of the various top level domains.
– Richy B.
Jun 5 at 9:43
1
@Qwertie Registrars are exactly a centralized list of all domains... the only issue is that it's not just one of them and also not all of them give easily access to their zone files so access might not be completely free or immediate.
– Giacomo Alzetta
Jun 5 at 12:03
5
@GiacomoAlzetta no, registrars at most have a list of domains they sponsor, not all domains in all TLDs. registries on the contrary obviously have a list of all the domains they maintain, which is available in gTLDs through open access to zonefiles like Richy B. said (but noting that not all registered domain is published so some will be missing). Some others TLDs, like .FR have "open data" initiative where you can get access to many things, including list of domains. Other registries publish daily "newly registered domain names list".
– Patrick Mevzek
Jun 5 at 15:33
|
show 7 more comments
It's brute force.
They have looked up the IP addresses of every domain name they can find, and then compiled the results into their own database.
answered Jun 4 at 15:29
Michael Hampton♦Michael Hampton
187k29 gold badges353 silver badges687 bronze badges
It's brute force.
They have looked up the IP addresses of every domain name they can find, and then compiled the results into their own database.
answered Jun 4 at 15:29
Michael Hampton♦Michael Hampton
187k29 gold badges353 silver badges687 bronze badges
answered Jun 4 at 15:29
Michael Hampton♦Michael Hampton
187k29 gold badges353 silver badges687 bronze badges
answered Jun 4 at 15:29
Michael Hampton♦Michael Hampton
187k29 gold badges353 silver badges687 bronze badges
answered Jun 4 at 15:29
Michael Hampton♦Michael Hampton
187k29 gold badges353 silver badges687 bronze badges
187k29 gold badges353 silver badges687 bronze badges
3
The only part that is unclear to me is how they find a list of every domain name as there isn't a central list anywhere. Edit: Looks like they don't have everything because my website that has been up for years is not listed
– Qwertie
Jun 5 at 4:38
12
@Qwertie: certificate transparency ledgers are a good place these days – practically everything that has a properly rooted TLS certificate will appear in there.
– Ulrich Schwarz
Jun 5 at 6:18
3
@Qwertie : The Centralized Zone Data Service ( czds.icann.org/en ) could be a good starting point as well - it gives access to a large number of 'zone files' of the various top level domains.
– Richy B.
Jun 5 at 9:43
1
@Qwertie Registrars are exactly a centralized list of all domains... the only issue is that it's not just one of them and also not all of them give easily access to their zone files so access might not be completely free or immediate.
– Giacomo Alzetta
Jun 5 at 12:03
5
@GiacomoAlzetta no, registrars at most have a list of domains they sponsor, not all domains in all TLDs. registries on the contrary obviously have a list of all the domains they maintain, which is available in gTLDs through open access to zonefiles like Richy B. said (but noting that not all registered domain is published so some will be missing). Some others TLDs, like .FR have "open data" initiative where you can get access to many things, including list of domains. Other registries publish daily "newly registered domain names list".
– Patrick Mevzek
Jun 5 at 15:33
|
show 7 more comments
3
The only part that is unclear to me is how they find a list of every domain name as there isn't a central list anywhere. Edit: Looks like they don't have everything because my website that has been up for years is not listed
– Qwertie
Jun 5 at 4:38
12
@Qwertie: certificate transparency ledgers are a good place these days – practically everything that has a properly rooted TLS certificate will appear in there.
– Ulrich Schwarz
Jun 5 at 6:18
3
@Qwertie : The Centralized Zone Data Service ( czds.icann.org/en ) could be a good starting point as well - it gives access to a large number of 'zone files' of the various top level domains.
– Richy B.
Jun 5 at 9:43
1
@Qwertie Registrars are exactly a centralized list of all domains... the only issue is that it's not just one of them and also not all of them give easily access to their zone files so access might not be completely free or immediate.
– Giacomo Alzetta
Jun 5 at 12:03
5
@GiacomoAlzetta no, registrars at most have a list of domains they sponsor, not all domains in all TLDs. registries on the contrary obviously have a list of all the domains they maintain, which is available in gTLDs through open access to zonefiles like Richy B. said (but noting that not all registered domain is published so some will be missing). Some others TLDs, like .FR have "open data" initiative where you can get access to many things, including list of domains. Other registries publish daily "newly registered domain names list".
– Patrick Mevzek
Jun 5 at 15:33
3
3
The only part that is unclear to me is how they find a list of every domain name as there isn't a central list anywhere. Edit: Looks like they don't have everything because my website that has been up for years is not listed
– Qwertie
Jun 5 at 4:38
The only part that is unclear to me is how they find a list of every domain name as there isn't a central list anywhere. Edit: Looks like they don't have everything because my website that has been up for years is not listed
– Qwertie
Jun 5 at 4:38
12
12
@Qwertie: certificate transparency ledgers are a good place these days – practically everything that has a properly rooted TLS certificate will appear in there.
– Ulrich Schwarz
Jun 5 at 6:18
@Qwertie: certificate transparency ledgers are a good place these days – practically everything that has a properly rooted TLS certificate will appear in there.
– Ulrich Schwarz
Jun 5 at 6:18
3
3
@Qwertie : The Centralized Zone Data Service ( czds.icann.org/en ) could be a good starting point as well - it gives access to a large number of 'zone files' of the various top level domains.
– Richy B.
Jun 5 at 9:43
@Qwertie : The Centralized Zone Data Service ( czds.icann.org/en ) could be a good starting point as well - it gives access to a large number of 'zone files' of the various top level domains.
– Richy B.
Jun 5 at 9:43
1
1
@Qwertie Registrars are exactly a centralized list of all domains... the only issue is that it's not just one of them and also not all of them give easily access to their zone files so access might not be completely free or immediate.
– Giacomo Alzetta
Jun 5 at 12:03
@Qwertie Registrars are exactly a centralized list of all domains... the only issue is that it's not just one of them and also not all of them give easily access to their zone files so access might not be completely free or immediate.
– Giacomo Alzetta
Jun 5 at 12:03
5
5
@GiacomoAlzetta no, registrars at most have a list of domains they sponsor, not all domains in all TLDs. registries on the contrary obviously have a list of all the domains they maintain, which is available in gTLDs through open access to zonefiles like Richy B. said (but noting that not all registered domain is published so some will be missing). Some others TLDs, like .FR have "open data" initiative where you can get access to many things, including list of domains. Other registries publish daily "newly registered domain names list".
– Patrick Mevzek
Jun 5 at 15:33
@GiacomoAlzetta no, registrars at most have a list of domains they sponsor, not all domains in all TLDs. registries on the contrary obviously have a list of all the domains they maintain, which is available in gTLDs through open access to zonefiles like Richy B. said (but noting that not all registered domain is published so some will be missing). Some others TLDs, like .FR have "open data" initiative where you can get access to many things, including list of domains. Other registries publish daily "newly registered domain names list".
– Patrick Mevzek
Jun 5 at 15:33
|
show 7 more comments
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f970089%2fhow-can-this-tool-find-out-registered-domains-from-an-ip-address%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Noted it doesn't work at all on IPv6 - too much data to index. And it also misses things that don't start in www.
– Criggie
Jun 5 at 1:07
@Criggie: That's probably not the reason. If they are not using rDNS, but just bruteforcing regular domain→IP records as Michael said, then the number of "possible" addresses cannot actually affect the process in any way. (After all, why would they index and store addresses which have no domains?) More likely they just didn't bother.
– grawity
Jun 5 at 9:02