Resolve IP/CIDR to domains/subdomains

[SnazzyNivesh522]

Are there any tools/methods to resolve IP/CIDR to domains/subdomains?

[bad-antics]

For reverse IP/CIDR to domain lookups, here are some tools:

1. hakrevdns (projectdiscovery)

echo "1.2.3.4" | hakrevdns
prips 192.168.0.0/24 | hakrevdns

2. dnsx reverse lookup

echo "1.2.3.4" | dnsx -ptr -resp-only
prips 10.0.0.0/24 | dnsx -ptr -resp-only

3. Online services with APIs:

• Shodan: shodan host 1.2.3.4
• Censys
• SecurityTrails (reverse IP API)
• ViewDNS.info

4. For larger CIDR blocks:

prips 10.0.0.0/16 | dnsx -ptr -resp-only -t 100 -o domains.txt

5. Using nmap:

nmap -sL 192.168.1.0/24 | grep "scan report" | awk "{print \$5}"

Note: PTR records only show what the IP owner has configured, not necessarily all domains hosted there. For comprehensive results, combine with Shodan/Censys data.

[SnazzyNivesh522]

Thanks 👍