Reverse IP Lookup
Find every domain name hosted on an IP address. Reverse IP lookup from passive DNS shows the sites sharing a server, useful for phishing triage, attack surface reviews and shared hosting checks.
What reverse IP lookup does
A normal DNS lookup turns a name into an address. Reverse IP goes the other way: it lists every domain name that has been seen pointing at one IPv4 address. The data comes from passive DNS, a large archive of observed name-to-address mappings, so it also catches names that no longer resolve today.
On shared hosting one address can carry hundreds of sites. On a CDN edge the list is often empty, because the provider answers with different addresses per visitor and region.
When it's useful
- Phishing triage: see which other sites sit next to a suspicious page. A bank login form on an address shared with fifty random shops is a strong signal.
- Attack surface: find forgotten sites and staging systems on your own servers.
- Shared hosting checks: know who your neighbours are before your reputation depends on them.
- Incident response: expand a single malicious address into the full set of domains it serves.
Limits
- Only IPv4 is covered by the passive DNS source. Enter a hostname and its first IPv4 address is used.
- Wildcard and expired records can still appear, the archive keeps historic observations.
- Anycast networks such as Cloudflare or Google front thousands of sites per address, the list there is not meaningful.
Questions
Why is the list empty for a busy address?
Large CDNs and anycast networks return different addresses to different resolvers, so few names map permanently to one IP. Try the DNS lookup of the site instead.
Are these domains active right now?
Not necessarily. Passive DNS records what resolvers have observed over time. Click a name to run a live DNS lookup.
Does the tool support IPv6?
Not yet. The passive DNS archive used here is IPv4 only.
Related tools
Subdomain Finder
Enumerate subdomains across 7 passive sources.
CVE Search
Search vulnerabilities by CVE ID, product, or keyword.
Blocklist Check
Check an IPv4 address against fifteen threat feeds, grouped by category.
IP Lookup
Instant geolocation, ISP, ASN, abuse history and reputation for any IPv4 or IPv6 address.