How many domains you will find depends on the hosting
Rough hit rates by hosting type. Shared hosting gives the richest lists, CDN edges give almost nothing.
| Hosting type | Hit rate | Typical result |
|---|---|---|
| PTR record | 100% | Reverse DNS, resolved live |
| Shared hosting | 95% | 100+ domains, up to 800 or more on one IP |
| Reseller hosting | 78% | 20 to 100 domains |
| VPS or dedicated | 55% | 1 to 20 domains, usually one owner |
| Cloud or VPC | 42% | Whatever the single tenant points there |
| CDN edge | 8% | SNI hides the customer list |
What you get back, and what you won't
Several sources plus a live PTR check, merged into one list.
Every result shows
- The PTR record (reverse DNS hostname) of the IP, checked forward too
- Every domain found, with duplicates removed
- A filter box to search inside the list
- Links from each domain to a fresh lookup or the live site
- The IP itself, linked to the full IP lookup
It can't show
- Sites nobody crawls, like intranet hosts or password-protected sites
- Domains that moved away recently, until the sources catch up
- Subdomains on the IP that have no public A record
- Anything behind Cloudflare or another CDN that hides the origin
A CDN edge IP serves millions of unrelated sites, so a reverse lookup on a Cloudflare or Fastly address won't give you anyone's customer list.
How to run a reverse IP lookup
An IP works best. A domain works too.
Paste an IPv4 address into the box above. If you have a domain instead, paste that: we resolve its A record first and run the lookup on the IP. Shared hosting IPs make good tests, try 199.59.243.200. Dedicated servers, CDN edges and freshly assigned cloud IPs usually return a few domains or none.
Investigating a website? Take its IP from the IP lookup or run dig +short example.com in a terminal. The crawlers behind the sources refresh on rolling cycles, so a newly assigned hosting IP can take up to a week before all its domains show up.
PTR records, shared hosting and CDNs
Why one IP shows 800 domains and another shows none.
Forward DNS turns a name into an IP (example.com to 93.184.216.34). Reverse DNS goes back the other way through PTR records in the special in-addr.arpa zone for IPv4 (ip6.arpa for IPv6). The network that owns the IP block sets the PTR, not the customer running a site on it.
Mail servers need one. Gmail, Outlook and Yahoo reject or heavily penalise mail from IPs without a matching PTR, and the hostname should point back to the same IP (forward-confirmed reverse DNS, FCrDNS). Home ISPs often put location into the name, which is one of the inputs for IP geolocation: c-71-198-22-179.hsd1.ca.comcast.net means Comcast cable in California. We show the PTR in green when there is one and "No PTR record configured" in grey when there isn't, which is common on hosting and freshly allocated ranges.
The hosting model decides the count
- Shared hosting (Namecheap, Bluehost, HostGator, GoDaddy starter plans): one IP, hundreds or thousands of small sites. These give the richest results.
- VPS or dedicated server: one to a dozen domains, usually one owner. Find one site, look up its IP, and you often find the owner's other projects.
- Cloud (AWS, GCP, Azure, Hetzner, DigitalOcean): one public IP per instance, showing whatever that tenant points at it.
- CDN edge (Cloudflare, Fastly, Akamai, CloudFront): millions of unrelated sites per IP. The edge picks the site from SNI in the TLS handshake, so the lookup tells you nothing.
If your own IP shows 800 random domains and you own a handful, you are on shared hosting. Bad neighbours can hurt your SEO and your email delivery, and a VPS or dedicated IP fixes both. It is worth checking before you sign up for a plan.
When a reverse IP lookup actually helps
The jobs people use it for most.
Mapping attacker infrastructure
You find a phishing domain. Resolve its IP and run a reverse lookup: often the same actor has dozens of similar names on that server. It is the cheapest way to go from one indicator to the whole set.
Checking the SEO neighbourhood
Before you buy shared hosting, look up the IPs the host advertises. If half the neighbours are gambling, adult or banned in your market, search engines may rate that block low, and that rubs off on your site.
Competitor research
A site you respect runs on its own server. The reverse lookup shows its sister projects, beta domains and internal tools that leaked into public DNS, without tipping anyone off.
Checking a migration
Moved to a new host? Look up the new IP and see if your domain is listed. If not, the crawlers haven't caught up yet, which is fine. For live resolution around the world use the DNS propagation checker.
Fixing email delivery
Mail bouncing? Check the PTR of your sending IP. If there is none, or it is a generic provider name, that explains the rejections. Ask your host for a PTR that matches a forward record.
Protecting a brand
Some hosts hand abandoned IPs to new customers. If a freed IP still carries your brand domains in the crawl indexes, clean it up before it turns into a phishing target.
Forensics
Sources keep old results for months after a domain moves. A reverse lookup on an old command-and-control IP can surface dormant sister domains the attacker may switch back to.
More about reverse DNS and our sources
What people ask after their first lookup. Skim what is interesting, skip the rest.
What "reverse" actually means
Normal DNS asks for the IP of a name. Reverse DNS asks for the name of an IP. It happens in in-addr.arpa for IPv4 (ip6.arpa for IPv6), where the address is written backwards: 198.51.100.42 becomes 42.100.51.198.in-addr.arpa, and a PTR record there returns the hostname. The owner of the IP block sets it on their nameservers. Customers can't set their own.
Why it isn't one-to-one
One IP can serve many sites through virtual hosts: the web server reads the Host: header, or SNI over TLS, and serves the matching site. Reverse DNS returns only one PTR per IP, the operator's chosen name. The hundreds of sites on a shared host aren't in PTR at all. They are found by crawling forward DNS and noting which names point to the IP, which is what reverse IP services do.
Why tools show different counts
Each service indexes a different slice of the web on its own schedule. Some focus on big hosting providers, some on newly registered domains, some on certificate transparency logs. We merge several and remove duplicates to catch what any single one misses.
Why CDN IPs are a dead end
Cloudflare, Fastly, Akamai, CloudFront and the rest put millions of customer sites behind a small pool of anycast IPs. A lookup on one returns nothing, because CDNs don't publish customer lists, or a huge random sample that means nothing. Finding the origin behind a CDN takes other methods: historical DNS, email headers, certificate transparency or origin misconfiguration scans.
Privacy and the law
Reverse DNS is public, anyone with a resolver can query it, and the domain lists come from forward DNS, which is public by design. Using the data to harass site owners, break in or send spam is still illegal almost everywhere. The tool is for due diligence, threat intelligence and honest infrastructure research.
Why some domains look odd
Two usual reasons: parked domains, registered and never used, often by resellers waiting to flip them, and recently expired ones the host hasn't cleaned up. Both once pointed here, so they stay in the index. For threat work, check each suspicious domain's current DNS to confirm it still points to the IP.
Reverse IP for IPv6
Same idea, but the address space is far too big to crawl fully. PTR records still work and are set by the operator. Reverse IP indexes stick to IPv4, where shared hosting lives, so on IPv6 the lookup is mostly useful for checking mail server PTRs and tracing operator networks.
How this differs from a normal IP lookup
The IP lookup is about the address itself: country, city, ISP, ASN, abuse contact, reputation and its one PTR. The reverse lookup is about which domains point at it. Together they answer "what is on this IP and who runs it" in two clicks.
Questions we get a lot
What is a reverse IP lookup?
Why does the same IP show different domain counts on different tools?
Why are no domains returned for some IPs?
Can I look up a domain instead of an IP?
Is this tool free?
What is a PTR record?
in-addr.arpa zone and mail servers use it to check senders. Home ISPs often put the location into the name.