IP History Lookup — Domain IP History & Reverse IP

Domain IP history answers: 'What IPs did this hostname use over time?' Useful when investigating phishing domains that briefly pointed to bulletproof hosts before switching to CDN.

Reverse IP answers: 'What domains sit on this IP right now?' Useful for shared hosting research and attack surface mapping. Choose input type based on your investigation starting point.

Historical data comes from passive DNS aggregators and third-party APIs that archive DNS changes. Coverage varies — new domains, private zones, or recently changed records may show sparse history.

We display a note when no archival data returns. Current DNS always reflects live resolution at query time.

Acquisition teams review whether a domain historically pointed to malware IPs. Incident responders trace when a compromised DNS record changed. Brand protection monitors typosquat domains hopping between hosts.

Pair history results with our IP reputation checker, WHOIS lookup, and SSL checker for full context.

When archival APIs include observation dates, we show them in the history table. Absence of dates does not mean inactive — only that the source did not timestamp the entry.

Passive DNS is incomplete by nature. Legal-grade investigations may require provider subpoenas beyond public archives. Rate limits on upstream APIs may temporarily reduce results during heavy use.

Investigators start with a suspicious domain from a phishing email or brand-abuse report. Entering that hostname here returns a table of IP addresses the domain previously resolved to when archival data is available.

Compare historical IPs against our IP reputation checker. An address that appeared only briefly may indicate bulletproof hosting or fast-flux tactics. Cross-reference observation dates with WHOIS registration updates and certificate issuance logs from SSL transparency search.

When you begin with an IP from firewall logs rather than a domain, reverse IP mode lists hostnames currently pointing at that address. Penetration testers map shared hosting targets where compromising one site might expose neighbors on the same machine.

PTR records appear when ISPs configure reverse DNS — useful for identifying mail servers and corporate gateways. Empty PTR does not mean no services; many cloud IPs omit reverse entries by default.

Export JSON results into your SIEM or ticket system as evidence of DNS state at investigation time. Note that passive DNS archives lag live DNS — always run a simultaneous live DNS lookup if you need the current A record for takedown requests.

For typosquat domains, run history on both the apex and www variants. CDN migrations may show a sudden shift from origin IP to edge anycast ranges — that pattern is normal during Cloudflare or Akamai adoption, not necessarily malicious.

Historical rows come from third-party passive DNS aggregators that crawl and archive public resolver responses worldwide. Coverage is strongest for popular TLDs and long-lived domains; newly registered or privacy-heavy zones may return empty tables until crawlers observe changes.

We display current A record IPs alongside history so you can see whether the domain moved recently. Empty history with a valid current IP usually means the domain is young or the archive has not indexed it yet — retry after major DNS changes propagate.

Chain tools: IP history → reputation check on each historical IP → reverse IP on suspicious addresses → WHOIS on related domains. This funnel quickly separates CDN noise from dedicated abuse infrastructure.

Legal teams should preserve screenshots and exported JSON with timestamps. Public passive DNS is admissible as supporting context in many jurisdictions but is not a substitute for registrar or hosting provider records obtained through lawful process.