Several hostnames, one IP address: how to read a security scan
A name is not always a device. Several DNS names may share a public IP, and one hostname may resolve to more than one IP. Those relationships change how a useful report groups evidence.
Start with the name-to-address map
Write down each hostname and the A or AAAA addresses it returned at scan time. For example, www.example.com and remote.example.com might both resolve to one public address; www.example.com might also resolve to a second ISP address. DNS answers can vary by time, region, resolver, CDN and load balancer.
Count the right thing
An observed TCP endpoint is a combination of public IP, protocol and port. If three hostnames lead to 203.0.113.10:443/TCP, that is one network endpoint observation with three associated names. It should not be billed or described as three separate open ports. Conversely, two different IPs answering on port 443 are two endpoints that may have different firewalls or servers.
Website behavior is different. HTTPS can route requests by hostname and TLS server name, so each hostname may have different certificates, headers or content even when the IP and port are shared. Keep those hostname findings separate. Mail records such as SPF and DMARC usually belong to the registered email domain, so avoid repeating the same DNS finding for every website alias.
Use differences to investigate
- Check whether the addresses belong to your organization, hosting provider or CDN.
- For dual ISPs, compare firewall and NAT rules on each route; confirm failover behavior.
- Review hostname-specific certificate and web findings separately from the shared IP port list.
- When observations disagree, keep the positive exposure visible and label a later timeout as inconclusive until a conclusive retest.
Torva’s Edge report maps hostnames to resolved addresses, groups recorded TCP endpoints by public IP, and keeps hostname-specific web observations with the hostname. It limits addresses checked per hostname; see scan coverage for the current scope.
Check your own domain. Try the public DNS, certificate and header instant check, then see Edge coverage for verified-domain scanning.
Further reading
Keep learning
RDP port open to the internet: what to check first · External vs. internal security scans: what each can see · All guides