Reverse IP Lookup

About Reverse IP Lookup

What an address says about itself: the name in its reverse DNS, the names on the certificate it serves, and the network that announces it.

It is worth being straight about what this is not. The tool usually sold under this name answers "what other sites are on this server", and that needs a passive-DNS dataset — a record of every name ever seen resolving to every address, accumulated over years. It cannot be derived from DNS, and it is not something to fetch from a third party on a visitor's behalf.

What *is* derivable is often enough. A shared host typically serves one certificate covering everything on it, so the names in that certificate are a real list of neighbours — obtained from the address itself rather than from anybody's database. Add the reverse name and the announcing network and you have most of what the question was really after.

Nothing answering on 443 is a normal result rather than a failure: a mail server, a home connection or a database host has no reason to serve HTTPS.

Where it helps

• Everything comes from the address itself, not from a third party's database about it.
• The certificate's subject alternative names are a genuine list of what the address serves.
• States its own limitation in the result rather than leaving you to discover it.
• Includes the announcing network, which answers "whose is this" more reliably than a name does.

Limits

• It is not a passive-DNS lookup and cannot list every site on a shared host. That needs historical data this does not have and does not fetch.
• A host behind a CDN presents the CDN's certificate, which tells you about the CDN rather than about the origin.
• Nothing on 443 means no certificate section, which is the normal case for most addresses.
• A certificate with a single wildcard name says very little, which is increasingly the common arrangement.

Frequently asked questions

Why can it not just list every site on the server?

Because DNS is a one-way index: it maps names to addresses and offers no way to ask the reverse question generally. The sites that answer it do so from a passive-DNS dataset — years of observed resolutions — which is a data-collection product rather than a lookup. Sending your query to one of those is also sending them the address you are interested in.

The certificate lists names I did not expect. What does that mean?

Usually that the address is shared hosting and the certificate covers every site on it, which is exactly the neighbour list people are after. Sometimes it means the address is a CDN edge, in which case the names tell you about the CDN's customers on that node rather than about one server.

Nothing came back from the certificate. Is the address dead?

No — it means nothing is listening on 443, which is the normal state for most addresses. Mail servers, DNS servers, databases and home connections have no reason to serve HTTPS. The reverse name and the network are still there and still answer the question of whose address it is.

Related tools

• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
• WHOIS — Registry records for a domain, an IP address or an AS number
• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• Port Checker — Test whether TCP ports accept connections

More Network & DNS tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is
• Ping (TCP) — Measure connection latency with repeated TCP probes
• What Is My IP — Your public address, and what a browser reveals about you
• WHOIS — Registry records for a domain, an IP address or an AS number
• DNS Propagation Checker — The same name asked of resolvers worldwide, and of the zone's own servers
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DKIM Lookup — A domain's DKIM keys, for a selector or by trying the common ones, and whether each is worth anything
• DMARC Lookup — A domain's DMARC policy, and what it actually asks receivers to do
• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• IP Blacklist Checker — Whether an address is on the blocklists that actually stop mail
• Traceroute — Every hop between this server and a host, with the time each one took
• Broadband Speed Test — Download, upload, latency and jitter, measured from this tab
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• Redirect Checker — Follow a URL's redirects hop by hop, and flag loops, downgrades and temporary redirects doing a permanent job
• IP Address Converter — Write an IPv4 or IPv6 address as an integer, hex, binary, expanded or mapped form, and see what kind it is
• MAC Address Lookup — Find the manufacturer behind a MAC address, and see what kind of address it is
• MAC to IP Converter — Build the IPv6 address a MAC forms with SLAAC, recover the MAC from one, or find a MAC's IP in an ARP table
• IP to MAC Lookup — Find the MAC address behind an IP: computed for multicast and EUI-64 addresses, or read from an ARP table
• DNSSEC Checker — Whether a domain's DNSSEC validates, and if not, whether it is the DS, a key, an algorithm or an expired signature