SNI: Can I find out which hosts share the same IP?

Question

The setup is the following:

I know that a host uses SNI (e.g. universal.at on IP 91.236.122.125, the test says so). I know that I can find out one other host that is also hosted on the same IP address by finding the default certificate that is delivered by the IP address by

curl -v https://91.236.122.125

So I can see that www.lidl-reisen.de is also hosted on this IP address. Are there further methods/tools to find out if there are even more hosts running on this IP address?

Tim · Answer 1 · 2016-02-24T20:54:08.833

1

A Google search for "find all domains on an ip" gives these three options

However this isn't a foolproof system, reverse IP databases are incomplete. I don't think there's an authoritative way to work this out, other than looking at the web server configuration.

edited Feb 24 '16 at 20:54

answered Feb 24 '16 at 20:25

Tim

31,888
7
52
78

These tests say, that they find only 1 domain for 91.236.122.125. – HorstKevin Feb 24 '16 at 20:30
I guess then the reverse IP databases aren't complete. Many of them say they're not complete. – Tim Feb 24 '16 at 20:42

SNI: Can I find out which hosts share the same IP?

1 Answers1