# Reverse IP API URL: https://www.deepinfo.com/data-api/apis/reverse-ip/ ## List the Domains on an IP Address or Its Whole Network. The Reverse IP API takes an address and returns the domains that resolve to it, each as a full domain record. Add `mask=24`, `16` or `8` and that call covers the network around it. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [Reverse IP reference](https://docs.deepinfo.com/reference/discovery/reverse-ip/) ### Widen One Address to Its /24. This request asks for all names in a /24, subdomains included. Each record carries its own A records, so you can see which address in the range it sits on. GET `https://api.deepinfo.com/v1/discovery/reverse-ip` [Reference](https://docs.deepinfo.com/reference/discovery/reverse-ip/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `ip` | string | Required | An IP address, for example `203.0.113.10`. | | `mask` | integer | Optional | `8`, `16`, `24` or `32`. Widens the lookup to the address’s network. Default `32`. | | `include_subdomains` | boolean | Optional | Include subdomains that resolve to the address. Default `false`. | | `page` | integer | Optional | Page number, from 1. | | `page_size` | integer | Optional | Results per page. | | `ordering` | string | Optional | Field to sort by. Prefix `-` for descending. | | `export` | boolean | Optional | Return the result as an export instead of a page. Default `false`. | | `export_format` | string | Optional | `json` or `csv`. | | `export_scope` | string | Optional | How much of each record to include: `basic`, `default` or `extended`. | Request curl: ```bash curl "https://api.deepinfo.com/v1/discovery/reverse-ip?ip=203.0.113.10&mask=24&include_subdomains=true&page_size=25" \ -H "apikey: YOUR_API_KEY" ``` Python: ```python import requests r = requests.get( "https://api.deepinfo.com/v1/discovery/reverse-ip", params={"ip": "203.0.113.10", "mask": 24, "include_subdomains": "true", "page_size": 25}, headers={"apikey": "YOUR_API_KEY"}, ) data = r.json() print(data["result_count"]) for d in data["results"]: print(d["punycode"], d["dns"]["a"]["ip_addresses"]) ``` JavaScript: ```javascript const params = new URLSearchParams({ ip: '203.0.113.10', mask: '24', include_subdomains: 'true', page_size: '25' }) const r = await fetch(`https://api.deepinfo.com/v1/discovery/reverse-ip?${params}`, { headers: { apikey: 'YOUR_API_KEY' }, }) const { result_count, results } = await r.json() console.log(result_count, results.map((d) => d.punycode)) ``` Response 200 OK · application/json ```json { "page": 1, "page_size": 25, "result_count": 3, "results": [ { "punycode": "acme.example", "unicode": "acme.example", "is_idn": false, "dns": { "a": { "ip_addresses": ["203.0.113.10"] } }, "ip_history": ["198.51.100.40", "203.0.113.10"] }, { "punycode": "shop.acme.example", "unicode": "shop.acme.example", "is_idn": false, "dns": { "a": { "ip_addresses": ["203.0.113.10"] } } }, { "punycode": "partner-portal.example", "unicode": "partner-portal.example", "is_idn": false, "dns": { "a": { "ip_addresses": ["203.0.113.57"] } } } ] } ``` ### One Parameter Sets the Radius. Without `mask`, the lookup is the single address. Each step down in prefix length widens it to the network the address belongs to. - **Mask `32` or none**: The address itself: 1 IPv4 address. - **Mask `24`**: Its /24 network: 256 addresses. - **Mask `16`**: Its /16 network: 65,536 addresses. - **Mask `8`**: Its /8 network: 16,777,216 addresses. ### What the Size of the Answer Tells You. A handful #### Likely One Owner A few domains on one address often share an owner. Check their registrant and certificate before you treat them as one. Thousands #### Shared Hosting or a CDN Many unrelated tenants on one address say more about the provider than about any of them. Pivot on an ownership signal instead. A network #### The Whole Range With a mask, the result covers all names the index sees in the block. Useful when an organization holds the whole range. ### From One Address to an Investigation. #### [Incident Investigation](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/) Turn an address from your logs into the names that resolve to it, then read each record for registration and certificate. #### [Threat Hunting](https://www.deepinfo.com/solutions/use-cases/threat-hunting/) Map what else an actor hosts next to a known malicious domain, on its address or in its network. #### [Attack Surface Management](https://www.deepinfo.com/solutions/use-cases/attack-surface-management/) Run your ranges with a mask and subdomains included, and compare what resolves into them with your inventory. ### What the List Does and Doesn’t Tell You. - **History**: Each record lists the addresses its name has resolved to in `ip_history`. For past DNS values with the dates they were observed, use [DNS History](https://www.deepinfo.com/data-api/apis/dns-history/). - **Owner of the address**: Reverse IP answers which names point at an address. For who holds the address, its network range and ASN, use [IP WHOIS](https://www.deepinfo.com/data-api/apis/ip-whois-lookup/). - **Totals**: `result_count` is the total number of matches across all pages. See [pagination](https://docs.deepinfo.com/getting-started/pagination/). ### Pivot on the Next Indicator. - [Reverse MX](https://www.deepinfo.com/data-api/apis/reverse-mx/) (Discovery): Domains whose mail goes through a given server. - [Reverse NS](https://www.deepinfo.com/data-api/apis/reverse-ns/) (Discovery): Domains that use a given name server. - [IP WHOIS](https://www.deepinfo.com/data-api/apis/ip-whois-lookup/) (Lookup): Network, range, ASN and registry for any IP address. ### See This Data at Work in the Deepinfo Platform External Attack Surface Management runs these lookups continuously over your assets and raises what changes as issues, and Deep Search & Insights opens the whole index to your analysts. - [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) (EASM) - [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/) (DSI) - [How the Platform Works](https://www.deepinfo.com/platform/how-it-works/) ### Questions About Reverse IP API **Does a match mean the domain points to the address today?** It means the domain’s A record pointed there when the index last observed it; each result carries the address in `dns.a.ip_addresses`. For names that used the address in the past, filter `ip_history` in [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/). **Can we pass a CIDR range?** Pass any address in the range and set `mask`. For example, `ip=203.0.113.10&mask=24` covers 203.0.113.0/24. **Can we combine an address with other conditions?** Yes, in [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/). Filter `dns.a.ip_addresses` together with a registrant, a certificate issuer or a registration date in one body. **How is the Reverse IP API priced?** As part of an API services plan, priced by volume and frequency, separately from the Deepinfo Platform. See [Data & API pricing](https://www.deepinfo.com/pricing/#data-pricing). **Can analysts run this pivot without writing code?** Yes. Deep Search & Insights runs Reverse IP and the other pivots in the Deepinfo Platform. See [Domain Search](https://www.deepinfo.com/platform/dsi/domain-search/). ### Run Your Own Ranges Through It. Most teams start with the addresses they own and one they are investigating. We set up access and answer schema questions on a short call. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [All API services](https://www.deepinfo.com/data-api/apis/)