How to find domains in an IP range with WorldIP.io owner data

issued.live Plus and Pro subscribers now get a free beta key to the WorldIP.io IP intelligence API. Plus comes with a WorldIP.io Pro key and Pro with a WorldIP.io Business key. issued.live finds the domains in an IP range, and the WorldIP.io key adds who holds the range. The key is emailed within one business day to the address on the subscription.

How to find domains in an IP range

A reverse IP lookup on a CIDR range returns every hostname issued.live's resolvers have recorded answering at any address in it. Write the prefix with a hyphen in place of the slash:

curl -sS https://issued.live/api/v1/range/157.240.17.0-24 \
  -H "Authorization: Bearer $ISSUED_LIVE_KEY"

Each row carries the hostname, its registrable domain, the address, first-seen and last-seen times and an observed count. The envelope reports how many addresses the query covered and whether the result was truncated. A range lookup covers up to 256 addresses, an IPv4 /24, and a single address goes to /api/v1/ip/{ip}. The observations begin in August 2026.

Find domains by SSL certificate

A certificate often names more domains than the one it was served for. /api/v1/cert/{id} returns a certificate's subject, its SANs, the key, the validity window and the Certificate Transparency logs it appeared in. Every certificate also carries an spki_sha256, and the SPKI pivot returns every certificate issued for the same key pair:

curl -sS "https://issued.live/api/v1/spki/746b5f9f4ac791f00e526234653f6f369b2b290b444a7c1dca810c9d7886a76e?limit=100" \
  -H "Authorization: Bearer $ISSUED_LIVE_KEY"

A shared key is usually a renewal. When it spans unrelated names, it ties together servers on addresses that a reverse IP lookup treats as separate.

JA4X fingerprint lookup

Every certificate record reports its JA4X fingerprint, which summarizes how the certificate is structured. JA4X works as a property of a certificate you already hold. issued.live offers no search by JA4X value, because one common value matches about a third of all Let's Encrypt certificates.

Who holds the range: the WorldIP.io key

The domains in a range show what runs there. The WorldIP.io key shows who holds the range and what kind of traffic leaves it:

• The organization, ASN and ASN type, regional registry ownership, city-level geolocation where it exists, and reverse DNS.
• VPN, proxy, Tor and datacenter classification, a trust score from 0 to 100 and blocklist hits.
• On the Business key, which comes with issued.live Pro: live BGP prefixes and multiple-origin conflicts, BGP anomaly events through the Pulse API and Web3 node roles.

The two feed each other. WorldIP.io's organization pages list an organization's largest address ranges; run each /24 of a range through the range endpoint, and the result is the domains seen on that part of the organization's network.

WorldIP.io also shows how many domains are hosted on an IPv4 address. issued.live lists them, with the dates each one was seen there.

Terms of the beta key

• Who qualifies: issued.live Plus and Pro subscribers. Basic is not included.
• Which key: Plus earns a WorldIP.io Pro key with 200,000 enriched lookups a month. Pro earns a WorldIP.io Business key with 1,000,000 enriched lookups a month.
• Delivery: by email within one business day, to the address on the issued.live subscription.
• Duration: through the WorldIP.io beta and for 30 days after WorldIP.io's paid plans launch, which is planned within the next 30 days. The key stays active while the issued.live subscription does.
• Beta: the WorldIP.io API is in beta, with the monthly quotas above and no uptime guarantee.
• Limits: the WorldIP.io limits above may change during the beta; key holders are emailed before any change.

The Tuxxin blog walks through a full hunt with both tools in hunting adversary infrastructure, and the WorldIP.io side of the beta covers how to detect residential proxies. Plans are on the issued.live pricing page.