SKILL / Infrastructure
Plans: Pro & AgencyReverse IP Relationships
Discover hostname and shared-hosting associations without treating them as proof of common ownership.
Read the step-by-step user guideReverse IP Relationships answers the question of what else lives at a given address: which hostnames and domains are publicly attributed to the same IP, and what that sharing might indicate. Investigators use it when a domain in a case resolves to an address and they want to see whether related sites, lookalikes or an operator’s wider footprint sit alongside it. Nexus returns the attributed hostnames as evidence-linked findings, each tied to the record that associated it with the address and the time of observation.
What you get
A set of hostnames attributed to an IP address, each with its source and a note on what the sharing may mean.
Using Reverse IP Relationships in an investigation
The findings are framed to prevent the most common error in infrastructure research. A shared address on a large hosting service places thousands of unrelated sites together, so Nexus reports every association as a hosting relationship and reserves stronger language for cases where additional evidence, such as matching registration details or shared name servers, supports a closer link. Hostnames that could not be confirmed against the address are shown as possible matches, and an empty result is recorded as an information gap.
Attributed hostnames can be added to the case graph as host entities connected to the address, then followed with Domain Registration Intelligence or DNS Posture to test whether the link holds. The evidence record travels with each finding into notes, briefs and PDF case reports, so a reviewer can see exactly what supported the association and what remained unresolved when the investigator reached a conclusion.
Example objectives
Run the Skill directly, or describe the objective in your own words — these are the kinds of questions it is built to answer.
Ask Nexus
“Which other hostnames are attributed to the IP address this domain resolves to?”
Ask Nexus
“Do the sites sharing this address look related to the subject, or is this a shared hosting range?”
Ask Nexus
“Are any of the hostnames on this IP lookalikes of our brand, and how strong is the evidence?”
How Reverse IP Relationships fits the investigation
A Skill is one move inside a case. The findings stay in the case file, where the evidence behind them can be checked, graphed and reported.
- 01
Choose or describe
Pick the Skill from the Skill Library, or describe the objective in your own words and let Nexus work out which Skills fit the question.
- 02
Review the evidence
Open the evidence record behind any finding and read the original public source before you rely on what it says.
- 03
Add to the case graph
Promote the people, organizations and identifiers you accept into the case relationship graph, straight from their evidence records.
- 04
Brief and report
Turn the case into a BLUF situation brief and, on Pro and Agency, into a structured PDF report with chain of custody.
Evidence before conclusions
What Reverse IP Relationships cannot establish
Nexus keeps supported findings, possible matches, contradictions and information gaps apart instead of blending them into one narrative. These are the boundaries Reverse IP Relationships states up front.
- Shared hosting does not establish common ownership or control; many unrelated sites can sit on the same address.
- Attribution reflects records available at the time of the search and may be incomplete or out of date, so a hostname’s absence does not mean it never used the address.
- A hostname match is a starting point for corroboration, not a finding of association on its own.
Best for
Teams that reach for Reverse IP Relationships most often.
Related OSINT concepts
The vocabulary this Skill works in, defined in the glossary.
Related Skills
Skills investigators commonly run next, in the same case.
Frequently asked questions
What does Reverse IP Relationships find?
Reverse IP Relationships in Nexus finds the hostnames and domains publicly attributed to an IP address and returns them as evidence-linked findings with the record and timestamp behind each one. The result groups the hostnames by how they relate to the address, notes when the address belongs to a large shared hosting range, and marks hostnames that could not be confirmed as possible matches rather than established associations.
If two domains share an IP address, are they owned by the same person?
Sharing an IP address does not mean two domains are owned by the same person. Shared hosting services, content delivery networks and cloud platforms place many unrelated sites on the same address. Reverse IP Relationships reports the sharing as a hosting relationship and points the investigator to corroborating checks, such as Domain Registration Intelligence or DNS Posture, before any ownership claim is made.
Which Nexus plan includes Reverse IP Relationships?
Reverse IP Relationships is included in the Skill Library on the Pro and Agency plans. Pro unlocks 43 of the 47 investigative Skills, including Reverse IP Relationships, DNS Posture, Domain Registration Intelligence and IP Network Location; Agency includes all 47.
How do I confirm a relationship suggested by a shared IP address?
A shared address is a lead, and Nexus is built to help test it. Add the hostnames to the case graph, run Domain Registration Intelligence to compare registration details and dates, run DNS Posture to check for shared name servers or mail services, and use Cross-Entity Correlation to weigh the combined evidence. A relationship becomes supported only when independent records agree, and the case keeps every record that contributed.