Reverse IP Lookup

What is a Reverse IP Lookup?

The technique known as Reverse IP Lookup is a way to identify hostnames that have DNS (A) records associated with an IP address.

A web server can be configured to serve multiple virtual hosts from a single IP address. This is a common technique in shared hosting environments. It is also common in many organizations and can be an excellent way to expand the attack surface during reconnaissance of a web server. If for example, your primary target web site appears to be secure, you may be able to gain access to the underlying operating system by attacking a less secure site on the same server. Potentially bypassing the security controls of the target site.

CIDR Search

Not only can you use the Reverse IP lookup to find web hosts on a single IP address, the query can also be performed against a CIDR network block. Search host records pointing to an IP network block (max /24).

Free users are limited by the number of results. Registered members can get up to 500'000 results from a single query using the web form or 10 million using the API (see details below).

Reverse IP Limits

	Free User	Member
Queries / day	20	500-20'000 # based on Plan
Max # of Results	500	Up to 10 million

With a membership get up to half a million results from a single query. A gold mine of data for security analysts, network defenders and other cyber security professionals.

Bing Reverse IP Search

There are usually not many reasons to use Bing, however, the Bing reverse IP search is sometimes one. Of the major search engines, Bing is the only service to offer a search query that resolves host names from an IP address.

A few years ago this was a popular method for finding virtual web hosts from an IP address. The search query is straight forward to use. Here is an example.

ip:254.32.x.x

Making a query such as one in the example will show results from hosts that are using the ip address that matches the query. Bing uses its search index to perform the reverse IP lookup and it can still be used today.

Popular Use Cases for the Reverse IP Lookup

Attack Surface Discovery for Blue & Red Teams

When attacking a host, one of the first things you will do is attempt to identify the attack surface of the host. With an understanding of the attack surface, the next step is to enumerate the applications and services in use. Following enumeration, a skilled penetration tester will be able to identify weak spots where vulnerabilities may become opportunities for exploitation.

Using the Reverse IP Lookup technique, it is possible to identify web sites on the host that may contain vulnerabilities to exploit. Even if no vulnerabilities are present, information disclosure can be used to build the penetration tester's knowledge of the target.

Simply identifying additional host names that are related to the target can further inform the information discovery cycle as the new hostnames may have additional DNS records that can point to new target hosts.

In the above OSINT discovery chart you can see that a reverse IP lookup is one part of the information discovery process.

In the above OSINT discovery chart you can see that a reverse IP lookup is one part of the information discovery process.

Incident Response and Threat Intelligence

Whether responding to an incident, identifying a botnet C2, or simply tracking down noisy Internet scanning, a reverse IP lookup can identify hostnames associated with an attacking system. These findings can further inform the investigation and lead to additional information sources.

Oversubscribed Web Hosting

When purchasing web hosting in a shared hosting environment, the web host provider sells small amounts of resources on a server to a number of web sites. To cut costs, the web host provider may oversubscribe, that is, sell more web sites than the server can handle. This is common in cheaper shared hosting providers, where a single web server can hosts thousands of small web sites. Using the reverse IP address lookup you can identify how many sites you are sharing that host with.

Web Hosting Reputation

Hosts with poor reputation can affect email delivery, blacklisting of your site, and search engine ranking. Use the reverse IP address lookup service to identify other sites on your host. Next, use investigative tools to identify if these other hosts are of poor quality, perhaps even spam or phishing sites.

How is the DNS data queried?

The bulk of the data for the reverse IP lookup tool comes from our crawls of the Alexa Top 1 Million sites, Search Engines (Bing), Common Crawl, Certificate Transparency, and the excellent scans.io project. The DNS A records total approximately 90G of plain text host records. The query simply searches through this data on our backend systems to find all hosts that match the IP address entered.

Reverse DNS Lookup

A reverse DNS lookup is a bit different to the commonly used definition for a reverse IP lookup. In the case of a reverse dns lookup, the IP address is checked against a DNS server to see if there is a PTR record associated with that IP address. This PTR record is assigned by the IP address block owner.

Reverse IP Lookup API

An easy to use simple API for quick access to our backend database. Use curl, python or any web request against the API url below to receive the results in plain text format.

curl "https://api.hackertarget.com/reverseiplookup/?q=2.2.2.2

Need more than 500000 results?

Simply use the &page= parameter on the API request. Will work for up to 10 million results (20 pages) for a single IP address (any membership level required).

curl "https://api.hackertarget.com/reverseiplookup/?q=2.2.2.2&page=2&apikey=zzzzzzz"

The API is simple to use and aims to be a quick reference tool. Like all our IP Tools there is a limit of 50 queries per day and a max of 500 results as a Free user. Remove limits with a Full Membership..

For those who need to send more packets upgrade to HackerTarget.com Enterprise Plans.