Lately I've been tracking a spammer on craigslist. I recently discovered that he's added a new technique to his arsenal, he registered a whole bunch of domain names but they all resolve to the same ip address.
Is there any way to take an ip address and get a list of all the domain names that resolve to that ip?
Oh, actually you can. After all, if there are companies constantly indexing the whole www, or even making a "backup" of it, why wouldn't be possible to index information about domains and IPs?
There are some free services that do that: You provide a public IP address, and you get a list with the domain names that resolve to it.
This can be quite useful for several purposes. Tracking a spammer seems to be one of them.
I don't know how accurate, current or complete is the information that these services provide, but they have helped me in dealing with situations like the one you described.
This will be very difficult because the data you are looking for is spread in the DNS-records/servers for these domains. Only the webserver on which the site/mail is hosted on knows which domains it should respond to.
You cannot easily find all the domains that point to an IP address. There are a couple reasons for this:
1- You are looking for all forward lookups that return this IP address. There is no way to get this information (you would have to look at every domain).
2- Reverse lookups (using PTR records) do not have to match all forward records.
> most rDNS entries only have one PTR record, DNS does not restrict the number if they are needed.
3- There is no query function that aggregates the data. I think there was an old, obscure query that was eventually removed because the size of the internet made it too slow.
You can try reverse DNS, but I'm not sure whether it will list all the domain names. If it won't then I don't know of any other way to do this.
