Recon
Recover virtual hostnames from target IPs
OSINT mapping from IP addresses to virtual hostnames.
overview
What hosthunter does
HostHunter reverses typical recon: start from IPs, recover the virtual hostnames each address serves. One IP often fronts many sites, so the interesting app rarely answers on the bare address.
Inputs are a targets file of IPs or a single -t address. --format writes CSV or TXT so the mapping lands in a spreadsheet or the next pipeline stage. Recovery leans on reverse DNS, TLS certificate names, and public OSINT sources.
Trickest runs HostHunter as a managed recon step that reads targets and writes a file plus a results folder. Place it after IP-range collection, then pass hostnames to httpx. For forward discovery from a domain, use subfinder.
use cases
Where hosthunter fits
Resolve hostnames behind an IP range
Hand HostHunter a file of target IPs to recover the virtual hostnames each one serves, turning a netblock into named assets.
Expand a cloud or ASN scope
After mapping an organization's IP ranges, use HostHunter to find the hostnames on them, broadening the in-scope surface.
Export results for reporting
Choose CSV output to drop the IP-to-hostname mapping straight into a spreadsheet or asset inventory.
Feed a web probing pipeline
Pass discovered hostnames to httpx so the workflow continues against named web hosts instead of bare IPs.
reference
hosthunter inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| targets | FILE | · | File of target IP addresses to map to hostnames. |
| single-ip-target | STRING | -t | Scan a single IP instead of a file. |
| format | STRING | --format | Output file format, CSV or TXT. |
Showing key inputs. hosthunter exposes 3 inputs in total.
example
Run hosthunter
# map a file of target IPs to hostnames, export as CSVpython3 hosthunter.py targets.txt --format csv[*] Loaded 6 target IP addresses[+] 203.0.113.10 vpn.example.com[+] 203.0.113.11 mail.example.com[+] 198.51.100.24 www.example.com[+] 198.51.100.25 api.example.com[+] 198.51.100.26 staging.example.com[!] 203.0.113.12 no hostname found[*] 5 hostnames written to hosts.csvguidance
Choosing hosthunter
Use HostHunter when you start from IP addresses and need the hostnames behind them. For forward discovery from a domain, use subfinder. For live web verification of the hostnames it finds, follow with httpx.
hakip2host
Also derives hostnames from IPs via TLS and reverse DNS. Different sources, narrower output.
subfinder
Forward discovery from a domain to subdomains. Opposite direction from HostHunter.
httpx
Probes which recovered hostnames are live web hosts. Run it after HostHunter.
faq
hosthunter questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run hosthunter yourself
An IP list feeds HostHunter, which recovers the hostnames behind each address and passes them to httpx for live probing before they land as a queryable output.
Facts on this page come from the live Trickest tool library.