a client of mine is currently hosting a web-project on one of his servers with some sub domains for previews, testing etc.

Those are really hard to guess sub domains like:

  • donottestme123789.example.com
  • preview_for_you15685485468.example.com

and so on ...

In the past days we noticed, that there are some users using those project instances which shouldn't even know of those :-)

Is there any way besides Google or brute forcing to get a full listing of sub domains from a domain?

  • Do you really mean for an entire top level domain? That means .com, .org, .net, .uk etc. Do you really mean for a domain such as example.com?
    – dunxd
    Commented Sep 28, 2010 at 8:49
  • I meant a domain - sorry - edited the question ...
    – Tim
    Commented Sep 28, 2010 at 8:59
  • @Christofian - no site:*.sitename.com will not work. Google does not allow wildcards in site search anymore.
    – user30238
    Commented Aug 7, 2013 at 6:35
  • I liked one answer from this forum - link . Searching for site:sitename.com -inurl:www gives all the sub-domains that are indexed by Search Engines.
    – user30238
    Commented Aug 7, 2013 at 6:36

8 Answers 8


No, there's no way other than bruteforcing.

And if you try that, you'll likely find yourself blacklisted.


Your client should have access and in some way control on the nameservers, that are authoritative for his domains.

Why not asking the DNS admin for a zone download/export?


Try this brute force script on Linux: It uses reverse DNS lookup (one name per IP), so it can't find virtual hosts (when at one IP more than one name).

vim /tmp/dnsscan.sh

Type i to enter INSERT MODE and paste this:



for i in `seq 1 255` ; do LIST="$LIST ${IPPFX}.$i" ; done

for i in $LIST ; do
    ENTRY="`host $i`"
    [ $? -ne 0 ] && continue
    ENTRY=`echo "$ENTRY" l sed -e 's/.* //' -e 's/\.$//'`
    echo -e "$i\t$ENTRY"

Then type [Esc]:wq and run

chmod 755 /tmp/dnsscan.sh


/tmp/dnsscan.sh your.ipv4.address

Replace your.ipv4.address with IPv4 without last octet!

For example http://www.wikipedia.org have next IP address:, so you need to execute this:

/tmp/dnsscan.sh 208.80.152

Result will be:    vrrp-gw-100.wikimedia.org    rr.pmtpa.wikimedia.org    upload.pmtpa.wikimedia.org    m.pmtpa.wikimedia.org    owa.wikimedia.org    payments.wikimedia.org   lvs-svc-test.wikimedia.org
... so on

If you need to find virtual hosts try Bing.com with real IP:

Example: http://www.bing.com/search?q=**IP:


Don't forget that if you use another website after using the test website, the test website's URL will likely show up in the other site's referrer log, which can lead to the admin of the other site knowing that yours exists.

  • 1
    That shouldn't happen unless you click a link to that other website (in which case the page containing the backlink would be the referrer). Otherwise that would be a huge invasion of privacy. Commented Dec 24, 2011 at 20:43
  • You don't necessarily need to click on a link for that, loading any external content (an image for example) on the test website will show up as a referrer on the external server.
    – arjarj
    Commented Dec 24, 2011 at 21:34
  • @arjaj: That's technically correct, and it's used for a lot of analytics applications. But I was referring to the act of the user visiting a webpage as the answer discusses. gbroiles' answer seems to suggest that simply using the same browser window/tab to visit another site will cause the current site's URL to be logged as a referrer. But that is simply not the case unless you arrive at the new site via a link (or redirect). Commented Dec 24, 2011 at 21:50

Yes, if you google site:*.sitename.com, google will wildcard the *, and display a list of sub domains.


If the hoster of your domain did not configure the nameservers properly, an AXFR transfer could list all the subdomains in your zone. I've seen hosting setups where AXFR to the outside world is denied (good), but it allowed an AXFR lookup for their hosted domains, from within their network, so anyone with a server or VPS could get such a list for any domain host


He who has access to the DNS zone files (or "control panel") can give you the complete list of subdomains. If the name servers that service the domain name allow for an AXFR transfer (or if the DNS manager allows that for you and your IP address) you can transfer copies of the zone locally and find the list yourself.

And there is always the case of a wildcard in the zone declaration, in which case any subdomain is a valid one...


Do you have access to plesk for their hosting, in there you could look under the subdomains tab of the main domain