如何发现并抓取网络服务器上的所有网站？

Question

我想查询几个内部的我知道的服务器正在运行 Web 服务器，并发现它们正在运行哪些网站。可以这样做吗？我需要查询的服务器正在运行 Apache、nginx 或 IIS。

例如：

server1.example.com
  - Using a web browser, this FQDN resolves to www.subsite.com
  - I know there is more than one website hosted here

server2.example.com
  - Using a web browser, this FQDN resolves to www.subsite2.com
  - I know there is more than one website hosted here

...