OTInstaller
Sign in

Find the domains hosted on an IP address

9 tools. 9 run with ot in a sandbox on Windows, macOS and Linux. Compare them side by side ↓

A reverse IP lookup lists the domains that point at an address, from passive DNS and the host names internet scanners and URL scanners recorded on it. On a dedicated server that list is the owner's other sites; on shared hosting or a CDN it is mostly strangers, which is why the first step is to check what kind of address it is.

With ot, in a sandbox

All IP address tools →

Windows, macOS and Linux, with Docker or Podman. Each tool runs in a read-only container that can reach only the sites it declares, and every result comes back in the same JSON shape.

osintverse-community/hackertarget

Finds a domain's subdomains and DNS records, or an IP's reverse DNS, network and hosted domains, via HackerTarget

Takes domain, ip address → finds dns record, domain, ip, organization…
No key · Docker
Verified publisher

osintverse-community/urlscan-search

Searches urlscan.io's existing scans of a domain, IP or URL: each page's title, server, IP, network and country

Takes domain, ip address, url → finds domain, ip, subdomain, url
No key · Docker
Verified publisher

osintverse-community/shodan-internetdb

Looks up an IP address in Shodan's free InternetDB: open ports, host names, software, tags and known CVEs

Takes ip address → finds domain, ip
No key · Docker
Verified publisher

osintverse-community/otx-indicators

Looks up an IP, domain, URL or file hash in AlienVault OTX: the threat reports that mention it, malware, tags

Takes domain, hash, ip address, url → finds document, domain, ip, location…
No key · Docker
Verified publisher

osintverse-community/pulsedive

Looks up an IP, domain or URL in Pulsedive: risk level and factors, linked threats and feeds, ports, technologies

Takes domain, ip address, url → finds domain, ip, location, organization…
No key · Docker
Verified publisher

osintverse-community/censys-host

Shows what Censys has seen on an IP address: open ports, services and software, network, location, host names

Takes ip address → finds domain, ip, location, organization…
Key required · Docker
Verified publisher

osintverse-community/onyphe

Summarises what ONYPHE's internet scans know about an IP address: open ports, services, domains, owner, location

Takes ip address → finds domain, ip, location, organization…
Key required · Docker
Verified publisher

osintverse-community/fofa

Shows what the FOFA search engine has seen on an IP address or domain: open ports, protocols and products

Takes domain, ip address → finds domain, ip, other
Key required · Python wheel
Verified publisher

osintverse-community/virustotal

Looks up an IP, domain, URL or file hash in VirusTotal: engine verdicts, reputation, tags, owner, DNS records

Takes domain, hash, ip address, url → finds dns record, document, domain, ip…
Key required · Docker
Verified publisher
ot install osintverse-community/hackertarget osintverse-community/urlscan-search osintverse-community/shodan-internetdb osintverse-community/otx-indicators osintverse-community/pulsedive

Installs the first 5 in one go; ot auto ip:… then runs every installed tool that takes an IP address and saves the results. No ot yet? Install it in one line.

The 9 registry tools side by side

The registry tools on this page, compared. Select a column heading to sort by it.
osintverse-community/censys-hostdomain, ip, location, organization…RequiredOnline, passiveNoDockerNo reports yetfewer than 10
osintverse-community/fofadomain, ip, otherRequiredOnline, passiveNoPythonNo reports yetfewer than 10
osintverse-community/hackertargetdns record, domain, ip, organization…NoneOnline, passiveNoDockerNo reports yetfewer than 10
osintverse-community/onyphedomain, ip, location, organization…RequiredOnline, passiveNoDockerNo reports yetfewer than 10
osintverse-community/otx-indicatorsdocument, domain, ip, location…NoneOnline, passiveNoDockerNo reports yetfewer than 10
osintverse-community/pulsedivedomain, ip, location, organization…NoneOnline, passiveNoDockerNo reports yetfewer than 10
osintverse-community/shodan-internetdbdomain, ipNoneOnline, passiveNoDockerNo reports yetfewer than 10
osintverse-community/urlscan-searchdomain, ip, subdomain, urlNoneOnline, passiveNoDockerNo reports yetfewer than 10
osintverse-community/virustotaldns record, document, domain, ip…RequiredOnline, passiveNoDockerNo reports yetfewer than 10

Facts from each tool's manifest and what people report about whether it works. "Reaches" says whether a run stays offline, reads public sources, sends requests about the target, or may notify them.

How to find the domains hosted on an IP address

  1. Check whether the address is a CDN or cloud edge first (cdncheck); if it is, its domains say little about one owner.
  2. List the domains and host names recorded on it (hackertarget, urlscan-search, shodan-internetdb).
  3. Take the domains that look related into the domain tools and compare their WHOIS and DNS.

Every registry tool here runs on your machine in a sandbox, and ot auto ip:… runs all the installed ones on one value.

Before you run one

Why do I get hundreds of unrelated domains?

Shared hosting and CDN edges serve many customers from one address. The list is most useful when it is short; when it is long, filter it for names that share a pattern with your target.

Which of these need an API key?

hackertarget, urlscan-search, Shodan InternetDB, OTX and Pulsedive answer without one for modest numbers of lookups. Censys, ONYPHE, FOFA and VirusTotal need a key from their own sites, most with a free allowance; each row says so.

Do these tools send my search anywhere?

No. ot runs each tool on your own machine in a read-only container that can only reach the sites the tool declares, and results stay in your results folder. The registry only counts installs.

More from an IP address

Owner and ASNReputationOpen portsLocationCDN or originAll IP address tools

Esc

Try

↑ ↓ to move↵ to open