Choose the address
Enter a public IPv4 or IPv6 address and select the available modules. Active probes require authorisation for the target.
infrastructure intelligence
Reverse IP lookup and IP reconnaissance
Start with a public IP address in Command One. Review domain associations where sources provide them, discover exposed services and trace network routing. Keep the evidence together in a case, then investigate connected domains in CommandDeck. A shared IP is a lead, not proof that websites have the same owner.
public sources only · free registration
from address to evidence
One public IP, a clearer infrastructure picture
Read public records
Check indexed hostnames, network registration and routing context. Reverse DNS can reveal a PTR hostname; it is not a list of every hosted website.
Inspect services
Naabu discovers ports; Nmap service detection examines the discovered host-and-port pairs. Indexed Shodan observations provide another view of exposed services.
Verify connections
Review sources and confidence in the case, link relevant evidence in CommandDeck and export findings. Confirm domain associations before drawing ownership conclusions.
IP intelligence modules
Exposure, routing and reputation — with context
Results depend on the selected modules, live worker availability and each source's coverage. No module guarantees a complete domain list or a finding for every IP address.
Shodan
Indexed IP intelligence can include observed ports, service banners and hostnames. Observations may be historical; an indexed service is not proof it is still exposed.
Naabu + Nmap service detection
Authorised port discovery feeds focused service detection. Nmap examines only the upstream discovered host-and-port pairs, rather than launching an unrestricted scan.
RIPEstat + OpenRDAP
Routing, ASN and network-registration records help place an IP in its network context. A network operator is not necessarily the owner of a website or its content.
InternetDB
Read a public exposure snapshot, including available ports, hostnames, tags and vulnerability references. References need verification; they are not a confirmed exploit finding.
VirusTotal reputation context
When available, source-reported detections and resolution history add reputation context. Command One confidence describes evidence quality, not a universal IP safety score.
CommandDeck
Keep findings, provenance, analyst notes and manual links together. On the web, explicit identifiers can lead into other research modules; iPhone and iPad remain infrastructure-only.
questions
Reverse IP lookup questions
What is reverse IP lookup?
It starts with an IP address and looks for domains associated with it in indexed or historical records. Reverse DNS instead asks for the address's PTR record. Command One combines available associations with broader IP reconnaissance.
Can it find every website on an IP?
No. Shared hosting, CDNs, proxies and changing DNS records limit what public sources reveal. A missing result does not mean no domains use the IP, and a historical association may no longer be current.
Does a shared IP identify a person?
No. Many unrelated websites share an address. On the web, separately evidenced domains and explicit identifiers can be investigated further, but co-hosting alone does not establish identity or common ownership. iOS searches and results are infrastructure-only.
Is IP reconnaissance passive?
Reading public indexes and registration records is passive. Naabu and Nmap send traffic to the target. Only run active modules against infrastructure you own or are authorised to assess.
What does a lookup cost?
Registration is free. Selected modules use credits; the credits page lists current module costs and plans. Availability and source coverage affect which modules can run and what they return.
Investigate an IP with evidence, not assumptions
Create an account to run available IP modules and review the resulting case. For lawful research and authorised infrastructure assessment only.