Find every domain on an IP.

Pass an IP address or CIDR. Get back every domain that resolves to it. Useful for hosting-cluster discovery and infrastructure attribution.

Talk to us Browse API docs

WHAT THIS API RETURNS

One pivot from IP to its full footprint.

The Reverse IP API queries the indexed corpus for every domain whose A or AAAA records point at a given IP address or CIDR block. Match is on current or historical DNS state; the response metadata distinguishes.

Pass the IP and optionally a CIDR mask. The corpus carries observation timestamps, so the same IP queried at different times can yield different domain sets.

This is one of the most common pivots in IR and hunt workflows. An IP surfaced in telemetry unlocks every domain that pointed at it, including domains long since moved off.

REQUEST

One endpoint, one required parameter.

Endpoint:

GET https://api.deepinfo.com/v1/discovery/reverse-ip?ip={ip}

Parameters:

Name	In	Type	Required	Description
ip	query	string	Yes	An IPv4 or IPv6 address such as `203.0.113.42`.
mask	query	integer	No	CIDR mask. When set, expand the lookup to the surrounding block.
include_subdomains	query	boolean	No	When true, surface FQDNs in addition to apex domains.
page	query	integer	No	Page number for paginated responses. Defaults to 1.
page_size	query	integer	No	Page size for paginated responses. Defaults to a sensible per-endpoint limit; see docs.
ordering	query	string	No	Field to sort by; prefix with `-` for descending order.
export	query	boolean	No	When true, returns the full result set as a downloadable export instead of paginated JSON.
export_format	query	enum	No	Format of the export when `export=true`. Typically `json` or `csv`.
export_scope	query	enum	No	Subset of fields to include in the export. See the docs for per-endpoint scopes.

Authentication is by API token in the request header. See docs.deepinfo.com for the full request reference.

SAMPLE RESPONSE

See what the API returns.

Real response structure for the Find every domain on an IP endpoint. Field coverage may vary based on query parameters and data availability.

JSON RESPONSE

{
  "_request": {"ip": "203.0.113.42"},
  "results": [
    {"fqdn": "deepinfo.com",     "first_seen": "2024-08-14", "last_seen": "current"},
    {"fqdn": "www.deepinfo.com", "first_seen": "2024-08-14", "last_seen": "current"},
    {"fqdn": "old-tenant-a.io",  "first_seen": "2022-01-04", "last_seen": "2024-07-30"},
    {"fqdn": "old-tenant-b.net", "first_seen": "2021-06-22", "last_seen": "2023-11-18"}
  ],
  "pagination": {"page": 1, "page_size": 50, "total": 12}
}

STRUCTURED VIEW

Request

203.0.113.42

Results

Count

First fqdn

deepinfo.com

First first seen

2024-08-14

First last seen

current

Pagination

Page

Page size

Total

Sample response shown. Real responses depend on query parameters, data availability, and API version. Talk to us for full schema documentation.

USE CASES

“Hosting-cluster discovery from one IP is the first pivot in most of our investigations. Returning the full domain set in seconds, not minutes, changed what we can do during live triage.”

— Threat Intel Analyst, National Telecom Operator

CONTINUE EXPLORING

Other lookup APIs.

API

GET STARTED

Run a reverse-IP pivot, from any address.

We'll set up token access and walk through how teams plug this into IR and ASM workflows.

Talk to us Browse API docs

Find every domain on an IP.

One pivot from IP to its full footprint.

One endpoint, one required parameter.

See what the API returns.

Workflows this API plugs into directly.

Incident Investigation and Response

Threat Hunting

Attack Surface Management

Other lookup APIs.

Current Whois state for any domain, in one call.

Current IP allocation state, in one call.

Current DNS state for an FQDN, in one call.

Current TLS state for a host, in one call.

Find every domain on an MX record.

Find every domain on a name server.

Capture a target page as the user sees it.

Detect the technology stack of a target, in one call.

Live web-page data for a target, in one call.

Scan a target's open ports, in one call.

Run a reverse-IP pivot, from any address.