Retrieve the domain names that resolved to an IP during a time frame. You can narrow results with record_types (A or AAAA).

Record results are broken down based on time range. For example, if censys.com resolved to 1.1.1.1 from January 1 to January 7 during two different ranges of January 1 to January 3 and January 5 to January 7, and you targeted January 1 through January 7 with your API call, then this endpoint will return one row for each of those distinct ranges.

To retrieve domain names for an IP with each result aggregated by name, use the bounds endpoint endpoint.

In a SOC environment, use this endpoint to see the exact time ranges a domain resolved to an IP, to confirm it was active during the incident window or to spot infrastructure reuse.

This endpoint is only available to organizations on the Censys Search and Censys Core plans.

Learn more about Censys Active DNS.