直接到https://www.webscan.cc/ 搜索即可
例如：
ngwb6bu.zxpf.com
可以看到：xss.zxpf.com 等
然后ping下就知道站点同IP：
ping ngwb6bu.zxpf.com
PING ngwb6bu.zxpf.com (43.129.74.121): 56 data bytes
64 bytes from 43.129.74.121: icmp_seq=0 ttl=109 time=85.442 ms
64 bytes from 43.129.74.121: icmp_seq=1 ttl=109 time=86.288 ms
^C
--- ngwb6bu.zxpf.com ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 85.442/85.865/86.288/0.423 ms
$ ping xss.zxpf.com
PING xss.zxpf.com (43.129.74.121): 56 data bytes
64 bytes from 43.129.74.121: icmp_seq=0 ttl=109 time=102.514 ms
64 bytes from 43.129.74.121: icmp_seq=1 ttl=109 time=106.332 ms
64 bytes from 43.129.74.121: icmp_seq=2 ttl=109 time=101.533 ms
^C
--- xss.zxpf.com ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 101.533/103.460/106.332/2.070 ms
同ip下的所有站点查询——旁注查询 https://www.webscan.cc/
原文：https://www.cnblogs.com/bonelee/p/14772872.html