Member Avatar for atar

Hi there!!

Just wanted to ask please, if there's a way to discovering all the IP addresses and subsubdomains that related to a specified domain.

Thanks in advance!!

atar.

  • 3 Contributors
  • 4 Replies
  • 123 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by atar

Dani AI

Generated

As asked, finding "all" subdomains and IPs for an external domain is a common need. 's search-engine tip and 's WHOIS suggestion are good starting points, but a professional approach combines passive OSINT with controlled active enumeration. It is important to set expectations: you can rarely guarantee complete coverage because of private hosts, wildcard DNS, CDNs/proxies and ephemeral services.

A practical, repeatable workflow:

  1. Passive collection: query certificate-transparency and passive-DNS sources to harvest candidate names.
  2. Automated enumeration: run multi-source tools to aggregate results and brute-force likely names.
  3. Resolve and dedupe: resolve candidates to A/AAAA records with a fast resolver and remove wildcard hits.
  4. Enrich and map: map IPs to ASNs and query Shodan/Censys for historical/more evidence.
  5. Validate safely: try AXFR and non-invasive scans only with permission, then document findings.

Quick examples (use responsibly):

amass enum -d example.com -o subdomains.txt
dig @ns1.example.com example.com AXFR

Practical troubleshooting and cautions: detect wildcard DNS by resolving a random nonsense name; treat CNAMEs to Cloudflare/Akamai/other CDNs as likely proxying — origin IPs can be hidden. Combine CT logs with passive DNS to recover historical or origin IPs. Be aware of rate limits, false positives from shared hosting, and legal/ethical limits on active scanning — obtain authorization before probing non-owned systems. Repeat the collection periodically; new certificates and DNS records appear often.

Tools and references: OWASP Amass (https://github.com/OWASP/Amass), Sublist3r (https://github.com/aboul3la/Sublist3r), and the certificate-transparency viewer (https://crt.sh).

Member Avatar for joliving

Can use google to find most subdomains of a particular domain.

Exp: search for *.yahoo.com google will display most of the subdomains for yahoo.com domain.

Member Avatar for atar

Thanks you about your response. But I'm looking for more professional tool which enable to achieve this goal rather then google.

However, I'll try it.

Greetings!!

Atar.

Member Avatar for Jessica1234

Thanks you about your response. But I'm looking for more professional tool which enable to achieve this goal rather then google.

However, I'll try it.

Greetings!!

Atar.

Hi,
There is a website named as 'whois.sc', you can check all the information related to a website here. I hope, you will get all the answers to your question using it.

Member Avatar for atar

Thanks you about your willingness to help, but unfortunately, it doesn't solve my problem.

Greetings!!

Atar.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.