IP AlmanacReverse IP · DNS history · PTR names
Who else is on this IP,and since when.
IP Almanac resolves a million popular domains with its own resolver and keeps every answer with the date we first saw it and last confirmed it. Look up an IP for the domains we've seen pointing to it, its PTR name and the network that routes it. Look up a domain for everywhere it has pointed.
- popular domains we resolve ourselves
- 1,000,000
- popular domains we resolve ourselves
- means not observed, never "no"
- null
- means not observed, never "no"
- first observation; history grows from there
- Oct 1, 2026
- first observation; history grows from there
/v1/ip/203.0.113.24{
"ip": "203.0.113.24",
"asn": {
"asn": 64500,
"route": "203.0.113.0/24",
"descr": "EXAMPLE-HOST - Example Hosting Ltd",
"country": "US",
"source": "IPtoASN",
"category": null,
"category_source": null,
"network_role": "stub"
},
"is_datacenter": null,
"provider": null,
"provider_ranges": [],
"ptr": {
"names": [
"srv24.examplehost.example"
],
"status": "positive",
"last_confirmed": "2026-10-06T14:02:11Z"
},
"domains": {
"current_count": 1412,
"sample": [
"bakery.example",
"lawfirm.example",
"plumber.example"
],
"first_observed": "2026-10-01T03:10:00Z",
"last_confirmed": "2026-10-07T09:41:00Z"
}
}Built for investigations
Start from an IP or a domain and see what shares it, where it moved and what kind of network is behind it.
Shared hosting
Who else is on this IP. On shared-hosting platforms and CDNs one address can carry thousands of domains; see each domain we've seen pointing to it, with when we first observed it and last confirmed it.
Phishing and brand abuse
Resolve a suspicious domain yourself and look up its IP: the network that routes it, the cloud or CDN range and PTR name where we have them, and the established domains we've seen pointing to the same address.
Infrastructure mapping
Follow where a popular domain pointed and when it moved between networks, and map any network's ranges to the cloud, hosting and CDN ranges inside them.
What's in an answer
Every field says where it comes from. What we measure ourselves is the core; the rest comes from lists their owners publish, and we say so.
- Measured by us
- Classified
- Published by operators
- Imported mapping
| Field | What it tells you | Source |
|---|---|---|
Domains on an IPip_domains | Every domain we've seen resolve to the IP, with first observed, last confirmed and when it left. | Measured by usOur resolver |
DNS historydomain_history | A domain's A and AAAA answers and CNAME chain over time. Timeouts and SERVFAIL are kept apart from NXDOMAIN and NODATA, and never erase an answer. | Measured by usOur resolver |
PTR namesptr | The reverse DNS name of an observed IP, with when we last checked and confirmed it. | Measured by usOur resolver |
Hosting movesdomain_hosting | The networks a domain's addresses moved through, one run per network, with when it arrived and left. | Measured by usOur DNS history with the ASN mapping |
Network categoryasn.category | What the routing network mainly is: isp, hosting, cdn, business, banking, education_research or government_admin. It describes the network, not the IP's tenant. Most networks are unclassified (null); category_source says whether a type is ours or ipverse's. | ClassifiedOur classification or ipverse as-metadata |
Cloud, hosting and CDN rangesprovider, is_datacenter, is_cdn | Whether the IP sits in a range AWS, Google Cloud, Microsoft Azure, Oracle Cloud, DigitalOcean, Vultr, Linode, Cloudflare or Fastly publishes. Not listed reads null, never "not hosting". | Published by operatorsThe providers' own feeds |
Tor, iCloud Private Relay and crawlersprovider_ranges | Whether the IP is a listed Tor exit, iCloud Private Relay egress, or a Google or DuckDuckGo crawler address. | Published by operatorsThe operators' own lists |
Routing ASNasn | The network that routes the IP, its name and registry country, and the network's mapped ranges. | Imported mappingIPtoASN, not our own BGP view |
Where the data is strong, and where it isn't
Every answer carries a coverage block, so you can tell an empty answer from a negative one.
Strong
- Shared-hosting platforms and website builders
- CDN and cloud addresses serving popular sites
- Popular registered domains and where they moved
Thin
- Residential and ISP addresses: usually the ASN only
- Brand-new and long-tail domains
- Subdomains such as www. and mail.
- History before October 1, 2026
Not offered
- Geolocation
- Abuse or reputation scores
- WHOIS and company ownership
- Guesses: unknown stays null
Plans and pricing
Every plan includes every lookup endpoint, the MCP server and the OpenAPI spec. Higher plans add monthly lookups and requests per minute.
Free
Try every endpoint
$0
Start free- 10,000 requests/month
- 30 RPM
- 2 projects
- All lookup endpoints
- MCP server and OpenAPI spec
- Email support
Starter
RecommendedFor investigations and side projects
$19/mo
Choose Starter- 600,000 requests/month
- 60 RPM
- 10 projects
- All lookup endpoints
- MCP server and OpenAPI spec
- Email support
Pro
For production pipelines
$79/mo
Choose Pro- 6,000,000 requests/month
- 300 RPM
- Unlimited projects
- All lookup endpoints
- MCP server and OpenAPI spec
- Email support
Prices in USD, billed monthly. One lookup or one page of results is one request.
Questions and answers
See who else is on the next IP you investigate
Free for 10,000 lookups a month, with every lookup endpoint included.