Best Free Reverse IP Lookup Tools (2026): 6 Options Compared
A reverse IP lookup answers one question: which other domain names point to this IP address? People use it to see whether a site sits on shared hosting, to look at the neighbours of a suspicious shop, to spot a network of sites built by the same owner, or as a first step in security research.
The catch is that no tool can list "all sites on a server". A web server does not publish which hostnames it serves. Every reverse IP service relies on DNS data someone collected earlier: resolving large lists of known domains, passive DNS from resolvers, or internet-wide scans. That is why two tools give two different lists for the same IP, and why the useful comparison is about data source, limits and freshness rather than a made-up score.
Quick comparison (October 2026)
| Tool | Free limit | Sign-up | Data source / method | Best for |
|---|---|---|---|---|
| HackerTarget | 20 queries/day; page says 50 results per query, but the free API returned up to ~500 in our test | No | Hostnames with DNS A records pointing to the IP | Quick checks and simple scripting |
| YouGetSignal | Not published — check their site | No | Connected’s domain/IP graph: current and historical mappings from its own internet scan | First seen / last seen dates |
| DNSlytics | Not published — check their site; history is Premium only | No for basic search | A/AAAA lookups of each domain and its www, re-resolved about every two weeks | Subnets (CIDR) and filtering |
| ViewDNS.info | Not published — check their site | No for the form; account to download the full report | Own DNS dataset (not described on the tool page) | A wider toolbox in one place |
| PromoPilot | 10 lookups/day without an account, 30 with a free one | No | HackerTarget’s free API + our own PTR, ISP/ASN and CDN check | Context: is this a CDN, who hosts it |
| SecurityTrails | Check their site (the site blocked our automated check) | Account required for the API | Historical DNS data | Deeper investigations |
The tools, by what they are best at
HackerTarget — best for quick free lookups and scripting
HackerTarget’s Reverse IP Lookup accepts an IPv4 address, a domain or a network block up to /24 and returns hostnames whose DNS A records point there. Its page lists the free limits as 20 queries a day and 50 results per query for both the web form and the plain-text API (handy for curl). In our own test on 13 October 2026, though, the free API returned up to about 500 hostnames for a large IP, so the real cap differs from the page; limits may change. Paid memberships go up to 500–20,000 queries a day and very large result sets. If you need a quick look at a shared server, this is the most transparent free option. For a very big hosting IP, even ~500 rows is only part of the list.
YouGetSignal — best for seeing when a domain was on the IP
YouGetSignal’s reverse IP tool now pulls results from Connected’s domain/IP association graph. According to the page, each row shows when the domain was first and last seen on the IP, whether the mapping is still active and where the observation came from. That history matters: an IP that hosted a phishing domain last year may be clean today, and the dates tell you which is which. The page does not publish a daily limit.
DNSlytics — best for subnets and filtering
DNSlytics explains its method openly: it performs an A or AAAA lookup of each domain name and of its www record, and its crawlers try to re-resolve every domain about every two weeks. You can search a whole CIDR subnet and, through the newer Domain Search interface, filter by TLD and other fields. Historical domains on an IP are a Premium feature. Free limits are not stated on the tool page, so check them before relying on it.
ViewDNS.info — best as part of a wider DNS toolbox
ViewDNS.info offers reverse IP next to reverse WHOIS, reverse MX/NS, IP history, DNS propagation and dozens of other lookups, with APIs for most of them. The web form is free to use. Downloading the full report asks you to log in. The tool page does not say how many results or queries you get for free, and our automated request for a result page was stopped by a browser check, so plan on using it in a normal browser.
PromoPilot Reverse IP — best when you need context, not just a list
Our Reverse IP lookup takes an IPv4 address or a domain (we resolve the domain to its first public IPv4). The neighbour list comes from the same place as HackerTarget’s: we call HackerTarget’s free API. What we add is context around the list: the PTR record (reverse DNS) from our own resolver, ISP, ASN and location, and a warning when the IP belongs to a CDN or a large cloud (Cloudflare, Fastly, Akamai, AWS, Google Cloud and others). On a CDN IP, thousands of unrelated sites share the address, and the neighbour list says nothing about the owner. That warning is the main reason to use ours.
SecurityTrails — best for deeper historical investigations
SecurityTrails is a historical DNS database used by security teams. Its website returned HTTP 403 to our automated check, so we could not confirm what a free account includes today. Its API documentation says every subscription level has a monthly quota and a per-second rate limit. Check current free access on their site.
A paid option worth knowing: DomainTools says its Reverse IP Lookup is free only for its paid Individual and Enterprise members, for IPs with up to 2,000 hosted domains.
Why the lists never match
- Different datasets. Each service resolves its own list of domains on its own schedule. A domain nobody has seen in DNS data will be missing everywhere.
- Stale records. A site that moved last week may still be listed on the old IP until the next re-resolution.
- CDNs and proxies. Behind Cloudflare and similar services, the IP you see belongs to the CDN, not to the origin server. Neighbours are other customers of the CDN.
- IPv6. Many services cover IPv4 only. Ours does too.
- Caps. Free tiers cut the list (HackerTarget’s page says 50 rows; its free API gave us up to ~500), so a large shared IP looks smaller than it is.
How to choose
- First find out what the IP is. Resolve the domain with Domain to IP and check the network with ASN lookup. If it is a CDN, a reverse IP list is not meaningful.
- For a quick, transparent sample use HackerTarget or our tool.
- If timing matters (was this domain here when the incident happened?), use a source with first/last seen dates, such as YouGetSignal, or a historical DNS service.
- For a whole subnet use DNSlytics or HackerTarget’s /24 search.
- For anything important, confirm each interesting domain with a fresh DNS lookup before you draw conclusions.
What our tool does not do
- We show up to 300 hostnames per IP from HackerTarget’s free API (which returned up to ~500 in our 13 October 2026 test). Results are cached for 24 hours. HackerTarget’s free quota of about 20 lookups a day is shared by all our visitors, so on busy days fresh lookups may be unavailable until tomorrow; IPs checked earlier still work from the cache, and PTR, ISP and ASN are always shown.
- IPv4 only. Domains with IPv6 addresses only are not supported.
- No history and no export. Per-user limit: 10 lookups a day without an account, 30 with a free account, no daily cap on Pro.
Related reading: how to find the IP address of a website, what an ASN and IP check shows and how to check if a website is legit.