Our company owns over 60 domains and a few external IP addresses (several domains share an external IP address). How do I discover all the domains that use a particular IP address (e.g. 69.x.x.7) without going through the DNS information on each domain? The particular webserver is running Windows 2003 and IIS6. Thanks, in advance, for your help!
The place to look is your DNS data. Your DNS administrator(s) should be able to to tell you which A records exist for the the address. As noted above you also need to get them to find all the CNAME records which point to one of these CNAME records.
If you know all the domains your company owns, you may be able fetch the data using zone transfers.
Reverse IP can do what you want.
These people charge for a big/long list of domains, but who doesn't...
You can use the IIS administrative API to enumerate your server's settings, including bindings. Have a look at this post from David Wang. There's a nice example of a script that'll do it, including your IP bindings.
You should also be able to look in the IIS metabase for details on your server config. The location is
Try This. It's free, but may not necessarily be 100% accurate.
Domaintool's Reverse IP may get you all the A records, but it's going to miss any CNAME records, subdomains, or forwarded domains. The lack of a centralized authority for this kind of information makes this particularly difficult. That was all hashed out in this question.
If you're also hosting DNS on Windows Server 2003, you can accomplish the same thing for free by searching for your IP addresses in all the files in %SystemRoot%\System32\DNS. Alternatively, if you can get even read access to the zone files from your DNS host, you might be able to do something similar.
You'll still have to come up with another way to handle CNAMEs though.