Reverse DNS (rDNS)

ELLIO maintains a daily-refreshed reverse DNS (PTR) dataset covering the IPv4 address space. PTR records answer “what name does this IP resolve back to” - a strong signal for attribution research, naming-convention pivots (*.censys-scanner.com), and infrastructure mapping.

Where to access it

Surface	What it gives you	When to reach for it
rDNS API	Per-IP PTR lookup and pattern search over the whole dataset	Enrichment in pipelines, hunting for naming patterns
Bulk Data feeds	Daily and weekly JSONL snapshots of the full dataset, with history	Offline analysis, joins in your data lake
ELQ search	The `rdns` field on Threat Intelligence documents	Combining rDNS with classifications, tags, and fingerprints

The API requires an API key with an active CTI plan. Create keys at platform.ellio.tech/dashboard/api-keys and send them as the X-API-Key header (or the apikey query parameter).

IP lookup

GET /v1/rdns/ip/{ip} returns the PTR records observed for an IPv4 or IPv6 address, or 404 when the address has none in the current dataset.

curl -H "X-API-Key: $ELLIO_API_KEY" \
  "https://api.ellio.tech/v1/rdns/ip/198.51.100.1"

{
  "ip": "198.51.100.1",
  "ptr": ["mail.example.com", "web.example.com"]
}

Search

GET /v1/rdns/search searches PTR values by pattern and returns ip/ptr pairs with cursor pagination.

curl -H "X-API-Key: $ELLIO_API_KEY" \
  "https://api.ellio.tech/v1/rdns/search?q=*.example.com&limit=100"

{
  "data": [
    { "ip": "198.51.100.1", "ptr": "mail.example.com" },
    { "ip": "203.0.113.24", "ptr": "web.example.com" }
  ],
  "cursor": "bWFpbC5leGFtcGxlLmNvbXwxOTguNTEuMTAwLjE",
  "limit": 100
}

Pass the returned cursor back as the cursor parameter for the next page; the last page omits it.

Patterns

* matches zero or more characters, \* matches a literal *; every other character matches literally, including _ and %.

Shape	Example	Endpoint
Exact	`mail.example.com`	Synchronous search
Prefix	`mail*`	Synchronous search
Suffix	`*.example.com`	Synchronous search
Interior or multi-wildcard	`foobar`, `scanner*`	Async search only

Async search

Interior- and multi-wildcard patterns require a scan of the full dataset, so they run as background tasks. Submit the pattern (at least 3 non-wildcard characters), then poll the task:

curl -X POST -H "X-API-Key: $ELLIO_API_KEY" \
  "https://api.ellio.tech/v1/rdns/search/async?q=*scanner*"

{ "task_id": "0b9f7f3e-6c1e-4b8a-9a67-2f8b3f1c5d21" }

curl -H "X-API-Key: $ELLIO_API_KEY" \
  "https://api.ellio.tech/v1/rdns/search/async/0b9f7f3e-6c1e-4b8a-9a67-2f8b3f1c5d21"

While the task is pending, running, or failed, the response is the task status object (with an error reason when it failed). Once it is done, the response carries the results and a next_page_cursor for pagination:

{
  "task": {
    "id": "0b9f7f3e-6c1e-4b8a-9a67-2f8b3f1c5d21",
    "query": "*scanner*",
    "status": "done",
    "created_at": "2026-07-11T09:15:27.123456Z",
    "started_at": "2026-07-11T09:15:28.001200Z",
    "completed_at": "2026-07-11T09:16:03.457800Z",
    "result_count": 5324,
    "truncated": false
  },
  "data": [
    { "ip": "198.51.100.1", "ptr": "scanner-01.example.com" },
    { "ip": "203.0.113.24", "ptr": "scanner-02.example.net" }
  ],
  "next_page_cursor": "c2Nhbm5lci0wMi5leGFtcGxlLm5ldHwyMDMuMC4xMTMuMjQ",
  "limit": 100000
}

An optional max_results parameter on task creation caps how many records the task stores; when the cap is hit the task is marked truncated.

Rate limits

Rate limits are applied per organization and can differ per plan; the effective limit and remaining budget are reported in the X-RateLimit-* response headers. Typical defaults:

Endpoint	Default limit
`GET /v1/rdns/ip/{ip}`	100,000 requests/min
`GET /v1/rdns/search`	100 requests/min
`POST /v1/rdns/search/async`	3 tasks/min
`GET /v1/rdns/search/async/{task_id}`	100 requests/min

Bulk data

The same dataset is available as downloadable snapshots - PTR rDNS IPv4 in JSONL, on two cadences:

Daily - a fresh snapshot per day, typically with 100+ days of history retained.
Weekly - a snapshot per week, typically with 17+ snapshots retained.

Browse and subscribe at platform.ellio.tech/dashboard/data-feeds/bulk-data; each feed page shows a sample preview and the exact record schema. See Bulk Data feeds for cadences, versioning, and programmatic download credentials.