Enumerating subdomains hosted on a single IP address

Written on 2023/02/23

As we crawl the Web like a search engine, we have plenty of data to enumerate all subdomains (or hostnames) having DNS entries pointing to a single IP address. To do so, there is one category of information (or dataset) you can query:

Using the resolver category

By using the official command line tool, you can easily execute this use case in a single call:

$ onyphe -search 'category:resolver ip: -since:7M | uniq hostname'

Output has been truncated, but there are many hostnames pointing to this IP address.