Skip to content
InternetData

The domains hosted on every IP address.

Each IPv4 and IPv6 address that registered domains resolve to, with how many there are and up to 1,000 of them, the most popular first. A domain counts on an address when its own A or AAAA record or its www host's points there, following any CNAME. A handful of domains on one address is usually one owner's server; hundreds of thousands is a hosting platform, a CDN or a parking service. Rebuilt weekly.

Request evaluation

Schema at a glance.

See documentation →

The schema and metadata are in the docs. It is published as CSVGZ.

iptotaldomains
118.107.235.1881netmgconsulting.com
148.251.176.1553tv-shop.net,tv-shop.org,tv-shop.se
69.163.186.20978020x.com,flightclubnewyork.com,fconl.com,flightclub.net,flightclub23.com,flightclublosangeles.com,flightclubnyc.com
186.202.87.1386confef.com,alfamontagens.com,fcaconsult.com,nutribrax.com,nutribrax.net,studiodgf.com
2a02:28f0:50cc:132::1veskuinterior.se
ID
ip_hosted_domains_v1
Entries
31,722,390
Refresh
Weekly
CSVGZ
1.42 GB

Downloading it from code.

Database API reference →

One call gets you the current IP Hosted Domains build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory, and checksums() returns the published digests to verify it against.

download()
Streams the current build to a file, which lands only once the whole transfer has arrived, so a failed one never leaves a truncated file behind.
downloadUrl()
The time-limited link the API redirects to, for your own downloader, a job runner or a CDN pull.
downloadBytes()
The build in memory, for a small database or a pipeline that never touches a filesystem.
metadata()
Row count, file sizes and when the build last updated. Poll it and fetch only when a new one has landed.
checksums()
The md5, sha1, sha256 and sha512 digests of one file, to verify it once it lands.
import os
from internetdata import InternetData
client = InternetData(os.environ["INTERNETDATA_API_KEY"])
# what is in today's build, without moving the file
meta = client.database.metadata("ip_hosted_domains_v1")
client.database.download("ip_hosted_domains_v1", "csvgz", "./ip_hosted_domains_v1.csv.gz")
sums = client.database.checksums("ip_hosted_domains_v1", "csvgz")
print(meta.updated, meta.entries, sums["sha256"])
load.pypip install internetdata
Also available for .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →

Where it occurs.

IP Hosted Domains holds 10,932,719 IPv4 addresses in the latest build. These are the countries and networks with the most of them; each opens its own page, as does every IP range.

By country

Of the 10,932,719 IP Geolocation places.

  1. United States3,389,876 · 31.01%
  2. China1,433,341 · 13.11%
  3. Hong Kong1,084,633 · 9.92%
  4. Germany925,697 · 8.47%
  5. France550,419 · 5.03%
  6. The Netherlands308,150 · 2.82%
  7. United Kingdom304,122 · 2.78%
  8. Japan299,256 · 2.74%
  9. Singapore240,212 · 2.20%
  10. Russia235,197 · 2.15%

By network

Each /24 counted for the AS announcing most of it.

  1. AS37963Hangzhou Alibaba Advertising Co.,Ltd.702,342 · 6.42%
  2. AS16509Amazon.com, Inc.624,416 · 5.71%
  3. AS14061DigitalOcean, LLC482,673 · 4.41%
  4. AS47583Hostinger International Limited422,412 · 3.86%
  5. AS24940Hetzner Online GmbH347,155 · 3.18%
  6. AS16276OVH SAS346,965 · 3.17%
  7. AS45090Shenzhen Tencent Computer Systems Company Limited285,172 · 2.61%
  8. AS14618Amazon.com, Inc.206,505 · 1.89%
  9. AS132839POWER LINE DATACENTER201,554 · 1.84%
  10. AS396982Google LLC163,281 · 1.49%

Getting your hands on it.

Teams match IP Hosted Domains against the names they already see, inside their own infrastructure, and never send a name anywhere to get an answer.

Threat investigation

Pivot from a malicious domain's address to the other domains on it, the most popular first, without a resolver query that tips anyone off.

Shared ownership

Tie a domain to its operator's other sites through the few other domains on its address.

Hosting footprint

See how many domains each address of yours, or a customer's, serves and which they are, without resolving a name yourself.

License the full database
Sales will quote on volume, term and whether you need redistribution rights.
Checksums published per file: md5, sha1, sha256 and sha512.
The ID fixes the schema, so a new build never changes the columns your parser reads.
Samples are cut from the current build, not a synthetic extract.

An official client for every major language.

All SDKs on GitHub →

Twelve official clients for the languages you ship in, each wrapping the database endpoints: list what you're licensed for, poll a build, follow the download redirect and verify what landed. Install commands are in the docs.

On this page

What does total count?

Every registered domain that resolves to the address, through its own A or AAAA record or its www host's, following any CNAME. domains lists them all where there are 1,000 or fewer, and the 1,000 most popular where there are more.

00 · Evaluate

Test the real build first.

An evaluation license puts a full current build in your hands, with no sampling, so you can measure it against your own traffic before anyone talks about terms.

Request evaluation
01 · License

Then license what you use.

Standard, for detection and decisions inside your own product and operations.
Redistribution, when the data ships onward inside what you sell, priced by scope rather than by seat.
Annual terms, a named contact, and monthly, quarterly or yearly payment.