Getting all domains hosted on an IP address

Question

I need to know how to enumerate all domains that are hosted on a single IP address. For example, if the server is using virtual hosting to host www.xyz.com , www.abc.com and www.abc123.com at the IP xxx.xxx.xxx.xxx, then how is it possible to deduce those three domains given the knowledge of only the single IP address. I've seen a few web services such as this https://dnslytics.com/reverse-ip do this but haven't been able to figure out exactly how this is achieved. I've tried nslookup PTR and dig -x to no avail.

I'd like to better understand this process. Thank you

Answer 1

You can use Yahoo to search "IP:185.199.111.153" to get some domains related this ip. Actually it's powered by Bing but not working on Bing.com for some reason.

Professional cyber security company always use spider(like google) to scan domains and build database.

Answer 2

There is an awesome site https://www.yougetsignal.com/tools/web-sites-on-web-server/ The best part about this is that this site is really efficient for doing a reverse IP lookup to the server.

Or else, you can use this site as well, https://reverseip.domaintools.com/search but it asks for money sometimes to show the full results.