Reverse IP Lookup to Find A Records at IP Address

Not sure if there is any Linux command that can do this. But you can use public DNS database websites likes securitytrails and domaintools (feature available as premium afaik).

You can just replace the IP with the one that you have in this link:

https://securitytrails.com/list/ip/142.250.185.238

dig / host / nslookup just lookup data in DNS. Specifically, in your use case they will be querying a PTR record. A PTR record is defined to point to the canonical name for that IP.

In other words, in DNS multiple names can point to the same address, but when going in reverse, there can be only one name for an IP.

So how to get all those other names?

Essentially you need to look for clues using whatever means you have available. Examples:

• If a SSL certificate contains multiple names, you can use the data in the SubjectAlternateNames
• From whois data?
• If you have access to a feed to DNS activity (eg. sniffing DNS reponses), then you could use that to maintain a huge database of name-ip pairs found on the internet.

That last one isn't something you would do yourself, but I wonder if there are people/vendors (eg. honeypot / firewall vendors) that on-sell this data as a service...