How can I find other domains hosted on an IP?

I see sites such as http://domainsbyip.com/ that allow people to input an IP or domain and it returns other domains hosted on that IP. How do you find this information?


I do not believe there is a 'programmatic' way to find this out. You would basically have to have a huge list of domain names (a lot easier than you might think) and then resolve them all and put that in a table. If you think about it, the only way that these websites would exist would be 1) a DNS A record in some domain, aaaabbbb.ddd.com 2) a virtualhost directive in apache that tells servers what content to serve when asked for a particular domain

Neither one of these methods can easily be found out by external entities.

It's very easy to get lists of domains from server logs, client logs (especially those people that might have spyware), etc.