Popular tools

Theme

IP to Hostname

Convert an IP address to its hostname and domain name. We read the address's PTR record from its holder's nameservers, check that the name leads back to the same IP, and show the website names the address answers with.

Sources: the address holder's nameservers · Team Cymru · the certificate the address serves on port 443

IPv4 or IPv6. A hostname works too: its first address is looked up in full, up to 7 more are listed.

Try

How to find the hostname of an IP address

Type the address above and press Find hostname. The tool reads the address's PTR record from the nameservers of whoever holds the address, then looks the name up again to confirm it leads back to the same IP: 1.1.1.1 is one.one.one.one, 8.8.8.8 is dns.google.

The hostname is the name the address's holder chose. A company's server usually carries the company's own name; a cloud server, a home connection or a phone usually carries the provider's default pattern, with the address's digits written into it.

Trust a hostname only when it points back. If the name's A or AAAA record doesn't return the same IP, someone wrote a name they don't control; the tool marks it as pointing elsewhere.

From an address to its hostname8.8.8.8, live 2026-10-23
  1. The address8.8.8.8IPv4 · Google, AS15169
  2. Its reverse name8.8.8.8.in-addr.arpathe four numbers reversed, under in-addr.arpa
  3. The holder's nameserverns1.google.comfound from the root down: IANA, ARIN, then Google
  4. The hostnamedns.googlepoints back to 8.8.8.8
PTR recordThe hostname is stored as a PTR record under the reverse name.
The holder sets itWhoever holds the address block writes the PTR: Google here.
Points backdns.google's own A records return 8.8.8.8 and 8.8.4.4, so the name is genuine.
Every lookup takes these four steps, then looks the name up forward to see that it leads back.

What the result shows

The head gives the hostname in one sentence, with the network behind the address and whether the name points back. Under it, a dashed card lists the site names from the address's own certificate: hints, not a list of every site.

Hostname shows each PTR name with its TTL and forward check, Domains the certificate and port-80 answers, Network the block, AS number and registry, and Commands the same lookup for a terminal. The column on the right traces where the name came from.

IP to hostname lookup of 8.8.8.8: the hostname dns.google, confirmed back to the IP, and the names in its certificateIP to hostname lookup of 8.8.8.8: the hostname dns.google, confirmed back to the IP, and the names in its certificateThe hostnameThe name in the address's PTR record, and whether it resolves back to the same IP.The certificate hintSite names from the certificate the address serves on port 443 when no site is named.The viewsEvery PTR name, the domains the address answers with, the network behind it, the commands.Where the name comes fromThe reverse zone's path from the root, and what the address itself answered on ports 443 and 80.
8.8.8.8 converted to its hostname: the name from the PTR record, the forward check, the network and the site names the address serves. Select a number to see what each part shows.

Can you find every domain on an IP address?

Not from DNS. An address has one place for names, its PTR record, and that holds whatever the address's holder chose, often the provider's default rather than any website.

Two more hints come from the address itself. The certificate it serves on port 443 when no site name is sent names its default site (RFC 6066 §3 forbids an IP address as the site name), and a redirect on port 80 may name a host. The tool shows both as hints, never as a full list.

Listing every domain that points at an address takes passive DNS: answers collected over months from many resolvers and crawls, sold by a few companies. We don't buy that data or pass your lookups to anyone, so the page says plainly what it can't see.

Four places a name can come from1.1.1.1, live 2026-10-23
PTR recorda name in 3 of 5one.one.one.oneOne name, chosen by the address's holder.
Certificate, port 443a name in 4 of 5cloudflare-dns.comone.one.one.one*.cloudflare-dns.comSSL.comThe default site's names when no site is named. A * name is a pattern, not a host.
Redirect, port 80a name in 0 of 5301 → https://1.1.1.1/On 1.1.1.1 it redirects to the bare address: no name.
Passive DNSnot usedNames seen pointing here over time, from a paid database. Not used.
Bars: for how many of five recorded lookups each source named a host (1.1.1.1, 8.8.8.8, 9.9.9.9, 104.18.0.1 and github.com's address, 2026-10-23). The tool shows the first three, as hints.

IP to domain on shared hosting and CDNs

One shared-hosting or CDN address serves many sites, so it has no single domain to find. Cloudflare's addresses are shared by all proxied hostnames, and a handshake that names no site is refused (TLS alert 40), so not even a default site shows.

A dedicated address answers with its own certificate: 9.9.9.9 serves dns.quad9.net and Quad9's other service names. Behind a CDN, the PTR names the CDN or nothing, and the site's name travels only inside each visitor's request. To go the other way, from a site to its addresses, use Domain to IP.

Shared addresses, asked without a site namelive 2026-10-23
151.101.0.223Fastly · AS54113
PTR
none · NXDOMAIN
Certificate
www.python.org · *.python.org · python.orgGlobalSign
Port 80
500
Also here
other sites Fastly serves, never listed
104.18.0.1Cloudflare · AS13335
PTR
none · NXDOMAIN
Certificate
refused: TLS alert 40, a site name is needed
Port 80
403
Also here
every hostname Cloudflare proxies

A dedicated address answers for itself: 9.9.9.9 sends Quad9's own certificate, dns.quad9.net and 21 more Quad9 names.DigiCert

151.101.0.223 is one of python.org's four addresses: the certificate Fastly sent names that one site, never the others it serves there.

How to find a hostname from an IP on Windows, macOS and Linux

On Windows, nslookup 1.1.1.1 prints the hostname on its Name: line. On macOS and Linux, host 1.1.1.1 prints it after "domain name pointer", and dig -x 1.1.1.1 +short prints the name alone. In PowerShell, Microsoft documents the reversed name: Resolve-DnsName -Name 1.1.1.1.in-addr.arpa -Type PTR.

Each command asks your own resolver, so it shows that resolver's cached copy and leaves the forward check to you. The tool asks the zone's own nameserver and confirms the name in the same step.

nslookup 1.1.1.1

The hostname is on the "Name:" line.

The same lookup on three systems1.1.1.1, recorded 2026-10-23
Terminal · Command Prompt

macOS

% host 1.1.1.1
1.1.1.1.in-addr.arpa domain name pointer one.one.one.one.the hostname

Linux

$ dig -x 1.1.1.1 +short
one.one.one.one.the hostname

Windows

C:\> nslookup 1.1.1.1
PS> Resolve-DnsName -Name 1.1.1.1.in-addr.arpa -Type PTR

Microsoft documents that nslookup returns the computer's name for an IP address, and documents Resolve-DnsName with the reversed name.

Each command asks the resolver the computer uses, so the answer can be a cached copy, and none of them checks that the name points back.

What the hostname tells you about an IP address

Who answers for the address, and often what it is: crawl-66-249-66-1.googlebot.com is Googlebot, ec2-3-80-0-1.compute-1.amazonaws.com is an AWS server in us-east-1, and mail-…google.com names are Gmail's outbound servers.

ISPs write the address and words such as dsl, dyn, pool or cable into home lines' names; RFC 8501's own example is 1.string.region.example.com. A city or airport code in a name is a hint the operator chose, never a location record.

A name proves nothing on its own: check that it points back before trusting it, as the tool does for every name it finds.

Six hostnames, read part by partlive PTRs and documented patterns, 2026-10-23

1.string.region.example.com

  • 1a host number
  • stringa word the ISP picks
  • regiona region
  • example.comthe ISP's domain
An ISP's pool name, RFC 8501's own examplepattern

ec2-3-80-0-1.compute-1.amazonaws.com

  • ec2EC2
  • 3-80-0-1the address
  • compute-1us-east-1
  • amazonaws.comAmazon's domain
An AWS EC2 server

lb-140-82-112-3-iad.github.com

  • lblikely a load balancer
  • 140-82-112-3the address
  • iadWashington Dulles's airport code
  • github.comGitHub's domain
GitHub's edge

crawl-66-249-66-1.googlebot.com

  • crawlcrawler
  • 66-249-66-1the address
  • googlebot.comGoogle's crawler domain
Googlebot

mail-am6eur05on2052.outbound.protection.outlook.com

  • mail-am6eur05on2052one sending server; Microsoft doesn't document the parts
  • outbound.protection.outlook.comMicrosoft 365's outbound mail domain
Microsoft 365 outbound mail

<reversed-ip>.bc.googleusercontent.com

  • <reversed-ip>the address, reversed
  • bc.googleusercontent.comGoogle Cloud's default domain
Any Google Cloud VMpattern
The live names belong to public servers (3.80.0.1, 140.82.112.3, 66.249.66.1 and 40.107.22.52) and each points back. A cloud's default name says who rents out the server, not who uses it.

IP to hostname: frequently asked questions

How do I find the hostname of an IP address?

Enter the address above and press Find hostname. The tool reads its PTR record from the nameservers of the network that holds the address and confirms the name resolves back to the same IP. From a terminal, nslookup 1.1.1.1 on Windows or host 1.1.1.1 on macOS and Linux prints the same name from your own resolver.

How do I convert an IP address to a domain name?

Look up its hostname: the PTR record gives one name, such as one.one.one.one for 1.1.1.1, and its last two labels are usually the domain. For a website's address, the certificate the address serves on port 443 often names the site itself. Neither lists every domain that uses the address.

Why is the hostname different from the website I visited?

Because the website and the address belong to different owners. The PTR name is set by whoever holds the address, usually the hosting provider or CDN, so a site on AWS shows an amazonaws.com name and a site behind Cloudflare often shows none. The site's own name lives in DNS records that point the other way.

Why does an IP address have no hostname?

Its holder never published a PTR record, which is optional. Many CDN addresses, most IPv6 addresses and many home connections have none, and Cloudflare's 104.18.0.1 answers that no such name exists. Private addresses such as 192.168.1.1 have no public hostname at all: only your own network's resolver can name them.

Can I find all websites hosted on one IP address?

Not reliably, and not from DNS. An address publishes at most a few PTR names, and its certificate names only its default site. Lists of every domain on an address come from passive DNS: resolver answers and crawls collected over time by commercial databases. Even those miss sites, and on a CDN address they would list thousands of unrelated ones.

What is the difference between a hostname and a domain name?

A hostname names one machine or service, such as mail.example.com or dns.google; a domain name is the registered name it sits under, such as example.com. In an IP's PTR record the hostname often carries the provider's own domain: ec2-3-80-0-1.compute-1.amazonaws.com belongs to amazonaws.com, AWS's domain, not to the customer's.

Can a hostname show where an IP address is?

Only as a hint. Some operators put a city, an airport code or a region into the name, like AWS's us-east-1 default names, but the PTR record itself holds no location, and the operator may name anything. For a location estimate from a geolocation database, use our IP Lookup; treat a city word in a hostname as the operator's label.

Why do Cloudflare IP addresses show no website?

Because one Cloudflare address is shared by all the hostnames Cloudflare proxies. Its servers refuse a TLS connection that names no site, and Cloudflare's own reverse zone usually answers that no PTR exists, as for 104.18.0.1. The site's name is only in each visitor's request, so no tool can tell the site from the address alone.

Is it legal to look up the hostname of an IP address?

Yes. A PTR record is public DNS data that the address's holder publishes for anyone to read, the same answer any mail server or log tool gets. On Reverse DNS the lookup sends nothing to the address. On this page the tool also connects to the address once on each of two ports: a TLS handshake on port 443 that names no site, to read the certificate it serves by default, and one plain HTTP request on port 80.

Why do two tools show different hostnames for one IP?

Most tools read a resolver's cached copy, which can lag after the holder changes the PTR, while this tool asks the zone's own nameserver. Some tools show only the first of several PTR records. Others don't check that the name points back, so a name the domain's owner never confirmed looks just as trustworthy.

Missing something?Suggest a feature or a new tool

More IP and DNS tools