Reverse IP Lookup
Reverse IP lookup returns all domain names hosted on a given IP address. It is used by threat hunters to identify other malicious domains sharing the same hosting infrastructure as a known bad actor — a technique known as infrastructure pivoting.
A reverse IP lookup answers one question: which domain names currently point at this IP address? Forward DNS goes from a name to an address; reverse IP walks the other way, using passive DNS observations rather than the PTR record, which an operator controls and rarely fills in.
In an investigation the value is the pivot. A phishing domain resolves to an address; the reverse lookup lists forty other names on the same address, registered the same week, with the same nameservers. Those names are candidates for the same campaign before any of them has been reported.
The limit is shared hosting. A CDN edge or a shared web host serves thousands of unrelated sites from one address, so co-location alone is not evidence: it is a lead to be confirmed with WHOIS, DNS history and reputation on each candidate.
Example
The lookup for one IP returns 38 hostnames. 31 were registered in the last 30 days and share a registrar and a nameserver pair with a domain already flagged for phishing. Each is a lead for the phishing feed, not yet a listed indicator.
In isMalicious
The reverse IP tool at /threat-intel/reverse-ip lists the co-hosted domains for an address; each result opens its own lookup, so a pivot from one indicator to its neighbours takes one click per candidate.
Frequently Asked Questions
What is Reverse IP Lookup?
Reverse IP lookup returns all domain names hosted on a given IP address. It is used by threat hunters to identify other malicious domains sharing the same hosting infrastructure as a known bad actor — a technique known as infrastructure pivoting.
How is Reverse IP Lookup related to DNS History?
Reverse IP Lookup and DNS History are both key concepts in threat intelligence. DNS history is a record of historical DNS resolution data for a domain — including all IP addresses it has ever resolved to, when changes occurred, and what nameservers have been used. It is used in threat investigations to trace infrastructure reuse and identify related malicious domains.
Related Terms
DNS History
DNS history is a record of historical DNS resolution data for a domain — including all IP addresses it has ever resolved to, when changes occurred, and what nameservers have been used. It is used in threat investigations to trace infrastructure reuse and identify related malicious domains.
IP Reputation
IP reputation is a score or classification indicating whether an IP address has been associated with malicious activity. Factors include appearance on blocklists, volume of spam sent, history of port scanning, C2 hosting, and abuse reports.
Put this intelligence to work
Query indexed indicators — IPs, domains, URLs, and hashes — in seconds.