The domains hosted on every IP address.
Each IPv4 and IPv6 address that registered domains resolve to, with how many there are and up to 1,000 of them, the most popular first. A domain counts on an address when its own A or AAAA record or its www host's points there, following any CNAME. A handful of domains on one address is usually one owner's server; hundreds of thousands is a hosting platform, a CDN or a parking service. Rebuilt weekly.
Schema at a glance.
See documentation →The schema and metadata are in the docs. It is published as CSVGZ.
| ip | total | domains |
|---|---|---|
| 118.107.235.188 | 1 | netmgconsulting.com |
| 148.251.176.155 | 3 | tv-shop.net,tv-shop.org,tv-shop.se |
| 69.163.186.209 | 7 | 8020x.com,flightclubnewyork.com,fconl.com,flightclub.net,flightclub23.com,flightclublosangeles.com,flightclubnyc.com |
| 186.202.87.138 | 6 | confef.com,alfamontagens.com,fcaconsult.com,nutribrax.com,nutribrax.net,studiodgf.com |
| 2a02:28f0:50cc:132:: | 1 | veskuinterior.se |
Downloading it from code.
Database API reference →One call gets you the current IP Hosted Domains build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory, and checksums() returns the published digests to verify it against.
download()downloadUrl()downloadBytes()metadata()checksums()import osfrom internetdata import InternetDataclient = InternetData(os.environ["INTERNETDATA_API_KEY"])# what is in today's build, without moving the filemeta = client.database.metadata("ip_hosted_domains_v1")client.database.download("ip_hosted_domains_v1", "csvgz", "./ip_hosted_domains_v1.csv.gz")sums = client.database.checksums("ip_hosted_domains_v1", "csvgz")print(meta.updated, meta.entries, sums["sha256"])
Where it occurs.
IP Hosted Domains holds 10,932,719 IPv4 addresses in the latest build. These are the countries and networks with the most of them; each opens its own page, as does every IP range.
By country
Of the 10,932,719 IP Geolocation places.
- United States3,389,876 · 31.01%
- China1,433,341 · 13.11%
- Hong Kong1,084,633 · 9.92%
- Germany925,697 · 8.47%
- France550,419 · 5.03%
- The Netherlands308,150 · 2.82%
- United Kingdom304,122 · 2.78%
- Japan299,256 · 2.74%
- Singapore240,212 · 2.20%
- Russia235,197 · 2.15%
By network
Each /24 counted for the AS announcing most of it.
- AS37963Hangzhou Alibaba Advertising Co.,Ltd.702,342 · 6.42%
- AS16509Amazon.com, Inc.624,416 · 5.71%
- AS14061DigitalOcean, LLC482,673 · 4.41%
- AS47583Hostinger International Limited422,412 · 3.86%
- AS24940Hetzner Online GmbH347,155 · 3.18%
- AS16276OVH SAS346,965 · 3.17%
- AS45090Shenzhen Tencent Computer Systems Company Limited285,172 · 2.61%
- AS14618Amazon.com, Inc.206,505 · 1.89%
- AS132839POWER LINE DATACENTER201,554 · 1.84%
- AS396982Google LLC163,281 · 1.49%
Getting your hands on it.
Teams match IP Hosted Domains against the names they already see, inside their own infrastructure, and never send a name anywhere to get an answer.
Threat investigation
Pivot from a malicious domain's address to the other domains on it, the most popular first, without a resolver query that tips anyone off.
Shared ownership
Tie a domain to its operator's other sites through the few other domains on its address.
Hosting footprint
See how many domains each address of yours, or a customer's, serves and which they are, without resolving a name yourself.
An official client for every major language.
All SDKs on GitHub →Twelve official clients for the languages you ship in, each wrapping the database endpoints: list what you're licensed for, poll a build, follow the download redirect and verify what landed. Install commands are in the docs.
What does total count?
Every registered domain that resolves to the address, through its own A or AAAA record or its www host's, following any CNAME. domains lists them all where there are 1,000 or fewer, and the 1,000 most popular where there are more.
How are the domains ordered?
The most popular first, by how widely the web links to each, then by name, so two builds of the same data list them the same way.
Does a shared address mean a shared owner?
Not by itself. A few domains on one address are usually one owner's, while an address carrying thousands is a hosting platform, a CDN edge or a parking service, where unrelated sites sit side by side. Read total first.
Which domains are in it?
The registered domains in Domain List: every one under the generic top-level domains and under .ee, .fr, .nu, .se and .sk, and those in use under the other country codes. Subdomains other than www don't count, and addresses that never appear on the public internet, such as 127.0.0.1, are left out.
How often is it rebuilt?
Weekly. The metadata call answers when the current build landed and how many rows it holds, before you fetch it.
Which formats does a build ship in?
Gzipped CSV. Each row is one address, so a prefix tree would not make it smaller.
How do we get it?
Under a Standard or Redistribution license, quoted per database. Get a quote names IP Hosted Domains to us, and Request evaluation puts the full current build in your hands to test first. Download sample gets you rows from it now.
Is there a lookup API?
No. You download IP Hosted Domains and query it in your own systems, so nothing is metered and no address leaves them. Each build comes from the database API, or to your webhook or your own storage. One address at a time, its page on this site shows what IP Hosted Domains holds for it.
What if a row looks wrong?
Send it to us and we'll tell you what we hold on it, when we last saw it and how. Corrections land in the next build.
Test the real build first.
An evaluation license puts a full current build in your hands, with no sampling, so you can measure it against your own traffic before anyone talks about terms.