Use
!ptr-ip to perform a reverse DNS (PTR) lookup for an IPv4 address. PTR records map an IP address to a hostname using the
in-addr.arpa domain. This lookup reveals the domain name associated with an IPv4 address and is commonly used for verification, logging, mail server checks, and network diagnostics.
PTR records are published by the organization that owns or manages the IPv4 address space. The authoritative DNS servers responsible for the
in-addr.arpa zone publish the PTR hostname chosen by the IP holder, or delegate control of the reverse-DNS zone to the organization that owns or manages the IP block. Because of this, reverse DNS often reflects operational or organizational details about the entity controlling the IP block.
!ptr-ip focuses specifically on DNS PTR resolution.
For IPv4 address analysis use
!ip4.
For IPv4 CIDR block analysis use
!cidr4.
For IPv4 WHOIS registration data use
!whois-ip4.
For BGP routing visibility use
!bgp-cidr4.
Reverse DNS is also valuable in Internet forensics. PTR hostnames often reveal hosting providers, mail server infrastructure, CDN edges, load balancer clusters, and operational fingerprints. Analysts use PTR lookups to understand service attribution, detect misconfigurations, and correlate IPv4 addresses with organizational or geographic hints.
Usually,
!ptr can be used in place of
!ptr-ip Usage:
!ptr-ip <ipv4-address>
Usage Examples:
!ptr 81.72.63.54!ptr 172.217.22.46!ptr 193.0.6.138!ptr 193.0.6.139!ptr 192.149.252.47!ptr 200.3.14.10!ptr 202.12.29.1!ptr 196.216.3.4!ptr 196.216.3.5!ptr 4.2.2.2!ptr-ip 1.1.1.1!ptr-ip 3.6.9.12!ptr-ip 62.103.147.250!ptr-ip 62.103.147.251Also see:
!help ptr