Or maybe it possible to do with some chaining of pjdscvr tools?

dnsx -ptr should help you on this

dnsx -ptr should help you on this

-ptr -d vulnweb.com
missing wordlist(w) flag required with domain(d) input

seems no(

Know some websites which have that func with API (hacker target). Think it work via extracting IP and then founding all domains hosted there , and maybe their subdomains (lvls/deep parameters) . think its a good option for subfinder

Also thanks for pdtm (extra helpful)

Found that some call it "reverse ip, rev host, domains etc "
but the logic. domain in - domains on same ip out (+their subdomains optionally...)

Here is example of nice one, but honestly want to use it in subfinder with c99 shodan and other keys features + other prjctdscvr tools integration for one liner scripts.

https://github.com/yuyudhn/reverseip_py
https://opendata.rapid7.com/

 echo '8.8.8.8' | dnsx -ptr -resp

      _             __  __
   __| | _ __   ___ \ \/ /
  / _' || '_ \ / __| \  /
 | (_| || | | |\__ \ /  \
  \__,_||_| |_||___//_/\_\ v1.1.1

                projectdiscovery.io

Use with caution. You are responsible for your actions
Developers assume no liability and are not responsible for any misuse or damage.
8.8.8.8 [dns.google]
``

Seem it will be combine of some tools for get what I exactly need. Anywhay, thx.