How one address serves several websites
A DNS A or AAAA record points a hostname to an IP address, and any number of hostnames can point to the same one. The server tells the sites apart by name: every HTTP request names the host it is meant for (RFC 9110, section 7.2), and a TLS connection can name it in the server name extension (RFC 6066, section 3).
An IP address therefore identifies a server or the entry point of a service, not a website or its owner.
Four setups behind a shared address
| Setup | Who uses the address | What sharing it tells you |
|---|---|---|
| Shared hosting | Customers of one hosting provider, on the same server | The sites have the same provider. Their owners are usually unrelated. |
| Dedicated server or VPS | One customer at a time, who may run several sites | Sites recorded in the same period may have one operator. The address can pass to another customer later. |
| CDN edge or reverse proxy | Customers of one proxy service | The sites use the same service. |
| Hosting platform | Customers of one platform, on the addresses it gives them | The sites use the same platform. |
When a Cloudflare DNS record is proxied, queries for it are answered with Cloudflare anycast addresses (Cloudflare documentation). GitHub Pages gives site owners a fixed list of four IPv4 addresses for an apex domain (GitHub Pages documentation).
A result page does not say which setup applies. The network it names announced the address when the data was retrieved; it can be a cloud provider or a CDN, not the host a site owner pays. IP History's hosting history guide lists the addresses several platforms give their customers and the network announcing each.
What a result shows for a shared address
reverseips.com lists hostnames from DNS observations that Profundis recorded with the address as their A or AAAA value: at most 30 observations, the most recent first, grouped by hostname. It does not resolve the hostnames when you search, so a listed host may point elsewhere now. The reverse IP method guide explains how hosts are counted and what the dates and the network describe.
On a CDN edge or a platform address, the hosts shown may have nothing in common but the service. Any public address can be looked up, but a result page is offered to search engines only when its sample holds at least three distinct registrable domains (www.example.com and mail.example.com count as one) and the address is not recognised as a shared edge of a CDN, a reverse proxy or Google's own services.
Why two tools list different domains for one address
DNS has no query that returns every hostname pointing to an address: a PTR record holds only the names the operator of its reverse zone published (see the reverse DNS guide). A reverse IP tool lists the names its own data source recorded with the address, so tools with different sources list different names.
- Period: a tool may keep names recorded years ago, or only names that still resolve to the address.
- Unit: a tool may count hostnames or registrable domains:
www.example.comandshop.example.comare two rows or one. - Limit: a tool may cap its results. Here the page says how many observations matched, and the rest can be searched on Profundis.
A name missing from a list may never have been recorded by that source.
Check which hosts share an address now
To see where two listed hosts point now, query a public resolver for each, replacing the reserved example names:
dig @1.1.1.1 +short example.com A
dig @1.1.1.1 +short example.net ARepeat with AAAA for IPv6. The hosts share an address now if the same address appears in both answers. A host can return several addresses, and a CDN or a load balancer can return different ones from one query to the next, so a single differing answer does not settle it. The reverse IP guide gives the steps for checking one host against the address you searched.
Inventory, abuse reports and authorised tests
Inventory of your own addresses. Look up an address you operate to see which hostnames were recorded on it, including names you had forgotten. Before you give up the address, check the current records of each name: one left behind will point to whoever receives the address next.
Abuse reports. A result names the network that announced the address when the data was retrieved, a starting point for finding who can act. On a shared address, name the hostname in the report: blocking the address itself can affect the unrelated sites on it (RFC 7754, section 4.2.2).
Scope of an authorised test. A list of hosts on an address is not a scope. On shared hosting, a CDN or a platform, the other names belong to third parties and the infrastructure to the provider. Test only systems whose owner has authorised it in writing, after confirming with that owner which listed hostnames are theirs.
Run a reverse IP lookup · Reverse IP method and limits · Reverse DNS and PTR records · Domains on the same IP address