Sign up ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

a client of mine is currently hosting a web-project on one of his servers with some sub domains for previews, testing etc.

Those are really hard to guess sub domains like:


and so on ...

In the past days we noticed, that there are some users using those project instances which shouldn't even know of those :-)

Is there any way besides Google or brute forcing to get a full listing of sub domains from a domain?

share|improve this question

migrated from Dec 24 '11 at 20:01

This question came from our site for system and network administrators.

Do you really mean for an entire top level domain? That means .com, .org, .net, .uk etc. Do you really mean for a domain such as – dunxd Sep 28 '10 at 8:49
I meant a domain - sorry - edited the question ... – Tim Sep 28 '10 at 8:59
@Christofian - no site:* will not work. Google does not allow wildcards in site search anymore. – user30238 Aug 7 '13 at 6:35
I liked one answer from this forum - link . Searching for -inurl:www gives all the sub-domains that are indexed by Search Engines. – user30238 Aug 7 '13 at 6:36

8 Answers 8

up vote 10 down vote accepted

No, there's no way other than bruteforcing.

And if you try that, you'll likely find yourself blacklisted.

share|improve this answer

Your client should have access and in some way control on the nameservers, that are authoritative for his domains.

Why not asking the DNS admin for a zone download/export?

share|improve this answer

Don't forget that if you use another website after using the test website, the test website's URL will likely show up in the other site's referrer log, which can lead to the admin of the other site knowing that yours exists.

share|improve this answer
That shouldn't happen unless you click a link to that other website (in which case the page containing the backlink would be the referrer). Otherwise that would be a huge invasion of privacy. – Lèse majesté Dec 24 '11 at 20:43
You don't necessarily need to click on a link for that, loading any external content (an image for example) on the test website will show up as a referrer on the external server. – arjarj Dec 24 '11 at 21:34
@arjaj: That's technically correct, and it's used for a lot of analytics applications. But I was referring to the act of the user visiting a webpage as the answer discusses. gbroiles' answer seems to suggest that simply using the same browser window/tab to visit another site will cause the current site's URL to be logged as a referrer. But that is simply not the case unless you arrive at the new site via a link (or redirect). – Lèse majesté Dec 24 '11 at 21:50

Try this brute force script in Linux: It uses reverse DNS lookup (one name per IP), so it can't find virtual hosts (when at one IP more then one name).

vi /tmp/

Type i and paste this:

for i in `seq 1 255` ; do LIST="$LIST ${IPPFX}.$i" ; done
for i in $LIST ; do
    ENTRY="`host $i`"
    [ $? -ne 0 ] && continue
    ENTRY=`echo "$ENTRY" l sed -e 's/.* //' -e 's/\.$//'`
    echo -e "$i\t$ENTRY"

Then type [Esc]:wq and run

chmod 777 /tmp/


/tmp/ your.ipv4.address

Replace your.ipv4.address with IPv4 without last octet!

For example have next IP address:, so you need execute this:

/tmp/ 208.80.152

Result will be:
... so on

If you need to find virtual hosts try with real IP:


share|improve this answer

If the hoster of your domain did not configure the nameservers properly, an AXFR transfer could list all the subdomains in your zone. I've seen hosting setups where AXFR to the outside world is denied (good), but it allowed an AXFR lookup for their hosted domains, from within their network, so anyone with a server or VPS could get such a list for any domain host

share|improve this answer

He who has access to the DNS zone files (or "control panel") can give you the complete list of subdomains. If the name servers that service the domain name allow for an AXFR transfer (or if the DNS manager allows that for you and your IP address) you can transfer copies of the zone locally and find the list yourself.

And there is always the case of a wildcard in the zone declaration, in which case any subdomain is a valid one...

share|improve this answer

Do you have access to plesk for their hosting, in there you could look under the subdomains tab of the main domain

share|improve this answer

Yes, if you google site:*, google will wildcard the *, and display a list of sub domains.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.