Reverse IP API
List the Domains on an IP Address or Its Whole Network.
The Reverse IP API takes an address and returns the domains that resolve to it, each as a full domain record. Add mask=24, 16 or 8 and that call covers the network around it.
IP 203.0.113.10
- mask 32 · 1 address
- acme.example
- shop.acme.example
- /24 · 256 addresses
- partner-portal.example203.0.113.57
- /16 · 65,536 addresses not expanded
- /8 · 16,777,216 addresses not expanded
Widen One Address to Its /24.
This request asks for all names in a /24, subdomains included. Each record carries its own A records, so you can see which address in the range it sits on.
| Parameter | Type | Description | |
|---|---|---|---|
ip | string | Required | An IP address, for example 203.0.113.10. |
mask | integer | Optional | 8, 16, 24 or 32. Widens the lookup to the address’s network. Default 32. |
include_ | boolean | Optional | Include subdomains that resolve to the address. Default false. |
page | integer | Optional | Page number, from 1. |
page_ | integer | Optional | Results per page. |
ordering | string | Optional | Field to sort by. Prefix - for descending. |
export | boolean | Optional | Return the result as an export instead of a page. Default false. |
export_ | string | Optional | json or csv. |
export_ | string | Optional | How much of each record to include: basic, default or extended. |
Request
curl "https://api.deepinfo.com/v1/discovery/reverse-ip?ip=203.0.113.10&mask=24&include_subdomains=true&page_size=25" \
-H "apikey: YOUR_API_KEY"import requests
r = requests.get(
"https://api.deepinfo.com/v1/discovery/reverse-ip",
params={"ip": "203.0.113.10", "mask": 24, "include_subdomains": "true", "page_size": 25},
headers={"apikey": "YOUR_API_KEY"},
)
data = r.json()
print(data["result_count"])
for d in data["results"]:
print(d["punycode"], d["dns"]["a"]["ip_addresses"])const params = new URLSearchParams({ ip: '203.0.113.10', mask: '24', include_subdomains: 'true', page_size: '25' })
const r = await fetch(`https://api.deepinfo.com/v1/discovery/reverse-ip?${params}`, {
headers: { apikey: 'YOUR_API_KEY' },
})
const { result_count, results } = await r.json()
console.log(result_count, results.map((d) => d.punycode))Response
{
"page": 1,
"page_size": 25,
"result_count": 3,
"results": [
{
"punycode": "acme.example",
"unicode": "acme.example",
"is_idn": false,
"dns": {
"a": { "ip_addresses": ["203.0.113.10"] }
},
"ip_history": ["198.51.100.40", "203.0.113.10"]
},
{
"punycode": "shop.acme.example",
"unicode": "shop.acme.example",
"is_idn": false,
"dns": {
"a": { "ip_addresses": ["203.0.113.10"] }
}
},
{
"punycode": "partner-portal.example",
"unicode": "partner-portal.example",
"is_idn": false,
"dns": {
"a": { "ip_addresses": ["203.0.113.57"] }
}
}
]
}One Parameter Sets the Radius.
Without mask, the lookup is the single address. Each step down in prefix length widens it to the network the address belongs to.
Mask 32 or none | The address itself: 1 IPv4 address. |
|---|---|
Mask 24 | Its /24 network: 256 addresses. |
Mask 16 | Its /16 network: 65,536 addresses. |
Mask 8 | Its /8 network: 16,777,216 addresses. |
What the Size of the Answer Tells You.
A handful
Likely One Owner
A few domains on one address often share an owner. Check their registrant and certificate before you treat them as one.
Thousands
Shared Hosting or a CDN
Many unrelated tenants on one address say more about the provider than about any of them. Pivot on an ownership signal instead.
A network
The Whole Range
With a mask, the result covers all names the index sees in the block. Useful when an organization holds the whole range.
The answer, on its /24 ip=203.0.113.10&mask=24
acme.exampleshop.acme.example
203.0.113.10 the address you pass · mask 32 is this one alone
partner-portal.example
203.0.113.57 elsewhere in the /24
203.0.113.0203.0.113.255
mask 24 · 203.0.113.0/24, 256 addresses · result_count 3
From One Address to an Investigation.
Incident Investigation
Turn an address from your logs into the names that resolve to it, then read each record for registration and certificate.
Threat Hunting
Map what else an actor hosts next to a known malicious domain, on its address or in its network.
Attack Surface Management
Run your ranges with a mask and subdomains included, and compare what resolves into them with your inventory.
What the List Does and Doesn’t Tell You.
| History | Each record lists the addresses its name has resolved to in ip_. For past DNS values with the dates they were observed, use DNS History. |
|---|---|
| Owner of the address | Reverse IP answers which names point at an address. For who holds the address, its network range and ASN, use IP WHOIS. |
| Totals | result_ is the total number of matches across all pages. See pagination. |
See This Data at Work in the Deepinfo Platform
External Attack Surface Management runs these lookups continuously over your assets and raises what changes as issues, and Deep Search & Insights opens the whole index to your analysts.
Questions About Reverse IP API
Does a match mean the domain points to the address today?
It means the domain’s A record pointed there when the index last observed it; each result carries the address in dns.a.ip_. For names that used the address in the past, filter ip_ in Domain Search.
Can we pass a CIDR range?
Pass any address in the range and set mask. For example, ip=203.0.113.10&mask=24 covers 203.0.113.0/24.
Can we combine an address with other conditions?
Yes, in Domain Search. Filter dns.a.ip_ together with a registrant, a certificate issuer or a registration date in one body.
How is the Reverse IP API priced?
As part of an API services plan, priced by volume and frequency, separately from the Deepinfo Platform. See Data & API pricing.
Can analysts run this pivot without writing code?
Yes. Deep Search & Insights runs Reverse IP and the other pivots in the Deepinfo Platform. See Domain Search.
Run Your Own Ranges Through It.
Most teams start with the addresses they own and one they are investigating. We set up access and answer schema questions on a short call.