Reverse IP Intelligence API — /api/v1/ip/reverse

Aggregated reverse-IP intelligence report. Combines PTR resolution, passive-DNS neighbour enumeration, ASN + GeoIP data, hosting classification, live SSL cert probe on :443, live HTTP banner probe, ICMP ping, 10 major RBL blacklist checks, forward-confirmed reverse DNS (FCrDNS), and a composite 0–100 risk score — all in a single request.

• Method GET
• Path /api/v1/ip/reverse
• Stability STABLE
• Version v2026-08-27
• Summary Aggregated reverse-IP intelligence: PTR + neighbours + risk score + blacklist + SSL + HTTP + FCrDNS + hosting classification.

Pass these as query-string parameters. Required params are marked. Defaults apply when omitted.

• ip (required) — string IPv4 or IPv6 address.
• server — string DNS resolver used for the PTR query. Default `Cloudflare`. One of `Cloudflare` · `Google` · `OpenDNS` · `Quad9`.
• mode — string Response shape. `report` (default) returns the full aggregated payload. `ptr` returns only the PTR record set — legacy shape used by chat/agent callers.

All successful responses follow `{ success: true, data: {...} }`. Legacy top-level fields (`data.data`, `data.raw`, `data.status`, `data.message`) are preserved. The new aggregated payload lives under `data.report`.

• data.data[] — array<object> PTR records `{name, class, type, ttl, data}`. Preserved for backward compatibility.
• data.raw — object Raw dig output. Preserved for backward compatibility.
• data.report.ip — string Normalized IP (zone-id stripped).
• data.report.family — string `IPv4` or `IPv6`.
• data.report.ptr — object `{records, status, resolver}` — PTR result set plus the resolver used.
• data.report.network — object `{asn, asn_org, isp, organization, network_range, type}` — MaxMind ASN + ISP metadata.
• data.report.geo — object `{country, country_code, state, city, latitude, longitude, timezone, continent, security_flags}` — GeoIP City data with anonymization flags.
• data.report.hosting — object `{badge, tone, reason}` — classifier: `Public Anycast` · `CDN` · `Cloud IaaS` · `Cloud (Shared)` · `Shared Hosting` · `Dedicated` · `VPN/Proxy` · `Tor Exit` · `Bulletproof` · `ISP / Unknown`.
• data.report.neighbours — object `{source, count, sample[], truncated, available, cached?, rate_limited?, reason?}` — passive-DNS neighbours from HackerTarget. Cached per-IP for 6h.
• data.report.ssl — object Live TLS handshake on :443 — `{available, subject_cn, issuer_cn, issuer_org, valid_from, valid_to, days_to_expiry, fingerprint256, sans[], alpn}`.
• data.report.http — object Live HTTP GET — `{available, protocol, status, server, x_powered_by, content_type, via, strict_transport_security, x_frame_options, content_security_policy, rtt_ms}`.
• data.report.ping — object ICMP ping — `{available, avg_ms, packet_loss_pct}`.
• data.report.fcrdns — object Forward-confirmed reverse DNS — `{checked, forward_confirmed, results[]}`. Each result: `{host, forward_ips[], matched}`.
• data.report.blacklists — object `{checked, hits, listed_on[], results[]}` — 10 major RBLs. IPv6 skipped.
• data.report.risk — object `{score, level, reasons[]}` — composite 0–100 score. `level` is `low` (<15) · `medium` (15–34) · `high` (35–59) · `critical` (≥60).

Real lookup for 1.1.1.1 — trimmed for readability but structurally accurate:

{
  "success": true,
  "data": {
    "data": [
      {"name": "1.1.1.1.in-addr.arpa", "class": "IN", "type": "PTR", "ttl": 583, "data": "one.one.one.one"}
    ],
    "report": {
      "ip": "1.1.1.1",
      "family": "IPv4",
      "ptr": {
        "records": [{"name": "1.1.1.1.in-addr.arpa", "class": "IN", "type": "PTR", "ttl": 583, "data": "one.one.one.one"}],
        "status": "NOERROR",
        "resolver": "Cloudflare"
      },
      "network": {"asn": 13335, "asn_org": "CLOUDFLARENET", "isp": "Cloudflare", "organization": "Cloudflare", "network_range": "1.1.1.0/24", "type": "ISP"},
      "hosting": {"badge": "Public Anycast", "tone": "info", "reason": "Cloudflare anycast resolver — not shared hosting"},
      "neighbours": {"source": "hackertarget", "count": 500, "sample": ["one.one.one.one", "example.com"], "truncated": false, "available": true},
      "ssl": {"available": true, "subject_cn": "cloudflare-dns.com", "issuer_org": "SSL Corp", "days_to_expiry": 116, "sans": ["cloudflare-dns.com", "*.cloudflare-dns.com"], "alpn": "h2"},
      "http": {"available": true, "protocol": "https", "status": 200, "server": "cloudflare", "rtt_ms": 124},
      "ping": {"available": true, "avg_ms": 27.4, "packet_loss_pct": 0},
      "fcrdns": {"checked": true, "forward_confirmed": true, "results": [{"host": "one.one.one.one", "forward_ips": ["1.0.0.1", "1.1.1.1"], "matched": true}]},
      "blacklists": {"checked": 10, "hits": 1, "listed_on": ["zen.spamhaus.org"]},
      "risk": {"score": 6, "level": "low", "reasons": ["1/10 blacklists list this IP (+6)"]}
    }
  }
}

Set `mode=ptr` for the legacy shape — identical to what `/api/v1/domain/reverse` returns. Use this from chat agents, MCP tools, or any client that only needs the PTR record set.

{
  "success": true,
  "data": {
    "data": [
      {"name": "1.1.1.1.in-addr.arpa", "class": "IN", "type": "PTR", "ttl": 583, "data": "one.one.one.one"}
    ],
    "raw": { "status": "NOERROR", "answer": [] }
  }
}

Errors return HTTP status codes paired with stable machine-readable codes. Match on the code field rather than the human-readable message.

• 400 INVALID_IP Not a valid IPv4 or IPv6 address.

Patterns we recommend when integrating this endpoint:

• Pick the right mode Use `mode=ptr` for chat-agent or minimal PTR-only integrations — same shape as before, roughly half the latency.
• Trust the badge Neighbour counts on public anycast resolvers (8.8.8.8, 1.1.1.1) are noisy — `hosting.badge = 'Public Anycast'` lets you skip acting on the raw count.
• Surface risk reasons `report.risk.reasons[]` explains every point in the score. Show them verbatim in dashboards instead of rolling your own scorer.
• Watch the cache flag `neighbours.cached: true` means the value came from the 6h in-memory cache — safe to trust, no additional HackerTarget quota consumed.
• IPv6 quirks `blacklists.checked` may be `0` for IPv6 — major RBLs are IPv4-only and are skipped for v6 targets.
• Partial failures are fine Any sub-signal may return `{available: false, reason: '…'}` on failure. Treat each card independently instead of failing the whole request.