IP Addresses
View all resolved IP addresses across your DNS estate — deduplicated with ISP geolocation, open port data, associated domains, and infrastructure distribution analysis.
An IP Address represents a unique IPv4 or IPv6 address resolved from A or AAAA records. DNS Watchdog extracts and deduplicates IP addresses across your entire DNS estate — if multiple records resolve to the same IP, it appears once with links to all associated records and domains.
Each IP is enriched with ISP geolocation data and port scan results, giving you a consolidated view of your infrastructure. You can see which IPs are shared across domains, where they are hosted, and what services are exposed.
Key fields
Identity
| Field | Description |
|---|---|
| IP Address | The IPv4 or IPv6 address |
| IP Version | 4 (IPv4) or 6 (IPv6) |
| Primary Record | The first record that resolved to this IP |
| Associated Records | All DNS records that resolve to this IP |
| Domain Names | All FQDNs that point to this IP address |
ISP and geolocation
DNS Watchdog performs an ISP lookup for each IP address to provide network and geographic context:
| Field | Description |
|---|---|
| ISP | Internet Service Provider name (e.g. "Amazon.com, Inc.", "Cloudflare, Inc.", "Hetzner Online GmbH") |
| ISP Organisation | Organisation name registered with the ISP — may differ from the ISP name if the IP is allocated to a specific customer |
| ISP AS Number | Autonomous System number identifying the network (e.g. AS16509 for Amazon, AS13335 for Cloudflare) |
| ISP Country | Country where the IP is geolocated (e.g. "United States", "Germany", "Singapore") |
| ISP Region | Region or state within the country (e.g. "Virginia", "Bavaria", "Île-de-France") |
| ISP City | City where the IP is geolocated (e.g. "Ashburn", "Frankfurt", "Singapore") |
| ISP Lookup Status | Whether the geolocation lookup succeeded or failed |
| ISP Lookup Timestamp | When the geolocation data was last refreshed |
This data helps you understand your infrastructure's geographic distribution, identify unexpected hosting locations, and spot shadow IT or forgotten infrastructure.
Port scan results
| Field | Description |
|---|---|
| Open Ports | List of open TCP ports detected on this IP |
| Services Detected | Services identified on open ports (e.g. nginx/1.25, OpenSSH 9.6, MySQL 8.0) |
| Port Scan Status | pending, completed, or failed |
| Port Scan Timestamp | When the last port scan was performed |
| Port Scan Error | Error details if the scan failed |
Associated issues
| Issue | Severity | Description |
|---|---|---|
| Inactive IP Address | Warning | No open ports or services detected — host may be down, fully firewalled, or decommissioned |
| All port exposure issues | Varies | Same port-related issues as Records apply at the IP level |
Port issues are raised at the IP level rather than per-record when multiple records share the same IP. This avoids duplicate alerts for the same underlying exposure.
Actions
- Lookup — perform an on-demand ISP lookup for an IP address
- View associated records — see all DNS records that resolve to this IP
- Filter by ISP, country, or AS number — narrow down IPs by network or geography
Common tasks
How do I identify shared infrastructure?
Sort or filter by IP address to find IPs with multiple associated records. If many domains resolve to the same IP, they share infrastructure — an issue on that IP (like an open port) affects all of them.
How do I find records hosted in unexpected locations?
Use the country or region filter to identify IPs geolocated outside your expected hosting regions. For example, if all your infrastructure should be in the US and EU, filter for other regions to spot anomalies.
How do I find decommissioned hosts?
IPs flagged with the Inactive IP issue have no open ports or services detected. This may indicate the host has been decommissioned, and the DNS records pointing to it are stale candidates for cleanup.
How do I understand my hosting distribution?
Filter by ISP or AS number to see how your infrastructure is distributed across providers. This helps identify shadow IT, forgotten infrastructure, or unexpected dependencies on specific hosting providers.
Certificates
Monitor SSL/TLS certificates across your DNS estate — track expiry dates, detect hostname mismatches, identify weak keys, and manage certificate lifecycle.
Web Forwards
Track provider-managed DNS redirects (HTTP 301/302) — monitor target URLs, validate redirect chains, and detect broken forwards across CSC and UltraDNS providers.