What this lookup counts
Reverseips.com returns up to 30 passive DNS observations from Profundis, with the most recent first. The table groups these observations by their full hostnames. Root domains and subdomains count separately; repeated records for the same hostname add to its observation count.
The upstream total describes matching observations, rather than unique hosts. The grouped table describes the returned sample. A large total alongside a short list of hosts can result from repeated observations or from the sample limit.
Example: five observations become three hosts
The values and dates below are invented for this guide. 192.0.2.10 is an IPv4 documentation address, and the example domains are reserved for documentation. This is not a lookup result.
| Hostname | Recorded date |
|---|---|
example.com | 2024-03-06 |
www.example.com | 2024-04-10 |
example.com | 2025-01-15 |
api.example.net | 2025-08-19 |
www.example.com | 2025-10-02 |
The grouped result has three hosts: example.com has two observations, www.example.com has two, and api.example.net has one. Counting just the root domains would give a different measure from the host count shown by this tool.
For example.com, 2024-03-06 and 2025-01-15 bound the dates in the returned sample. They do not establish continuous use of the IP between those dates, the first use of that IP or the last time it was used.
What the dates and network describe
The DNS source supplies coalesced first-recorded timestamps. The earliest and latest dates shown for a host are computed from the rows returned for that lookup. Older rows can fall outside the capped sample, and later observation of an existing value does not necessarily add a new first-recorded date.
Network context is computed from the IP when the data is retrieved, and each result page gives that date. It identifies the ASN announcing the address on that date. It cannot establish which network announced the IP on the date of a historical DNS record.
Shared addresses and attribution
A shared hosting server, load balancer or CDN can associate one address with hosts run by different organisations. An address may also be reassigned between observations. Check each hostname separately before linking operators or attributing activity.
A CDN edge address does not reveal the origin behind the CDN. For that address, this tool describes the observed names pointing to the edge. Even a large set of such names is not evidence that they share an origin or owner.
Check an observed association today
- Query the hostname for current A and AAAA records, for example
dig @1.1.1.1 example.com A. - Compare the returned addresses with the searched IP. Preserve the record type and the time of your check.
- Inspect the relevant record history on Profundis if you need observations beyond the sample.
- Use a separate reverse DNS query when you need the PTR names published for the address.
A current answer confirms what that resolver returned at the time of the query. It does not turn a historical association into evidence of ownership.
Related DNS history tools
DNS Timeline: See the MX, NS, TXT and CNAME records recorded for a root domain, with the date each was first recorded.
IP History: See the IPv4 and IPv6 addresses recorded for a root domain, with the dates of their records.
Profundis DNS search provides record-level searches, filters and exports beyond this free sample.
Documentation for the example values
RFC 5737 reserves the IPv4 documentation ranges. IANA documents the reserved example domains. These values keep the worked example separate from operational DNS data.
Run a reverse IP lookup · Reverse IP method and limits · Reverse DNS and PTR records · Domains on the same IP address