In this cases, how can we figure out all domains on a given IP?
First of all, we need get the IP adreess of a webserver.
We can use nslookup to ge it.
email@example.com:~$ nslookup www.newyorktimes.com 18.104.22.168
www.newyorktimes.com canonical name = www.nytimes.com.
Then, we can use the next alternatives.