Here's a method to discover what website Bindings (i.e. unique IP:port:HostHeader tuples for anyone not IIS-conversant) an IIS6 instance has configured.

This script takes 1 optional parameter - the resolvable name of the host you want to audit, defaulting to localhost. It outputs a colon-seperated record for each unique MachineName:Comment:IISObject-Name:IP:Port:HostHeader tuple.

I've only used it in a Domain-authenticated context hence can't speak for how it works in a Workgroup/etc environment when auditing remote hosts. It might not.

Invoke the script like this: cscript iis-bindings-audit.vbs //NoLogo [IIS-Server] >> output.txt .. with your chosen machine as IIS-Server.

You might like to wrap it in a foreach loop to audit multiple hosts and aggregate the results. The output format is structured to allow this aggregate result to be unambiguous when analysed later.