zh4ckDec 16
The Hacker‘s Choice

THC Release 💥: The world’s largest IP<>Domain database: https://ip.thc.org

All forward and reverse IPs, all CNAMES and all subdomains of every domain. For free.

Updated monthly.

Try: curl https://ip.thc.org/1.1.1.1

Raw data: https://ip.thc.org/docs/bulk-data-access

(The fine work of messede 👌)

What does everyone think? Need feedback before release tomorrow :)

Dec 16 at 10:52amWeb
Show threadNegative KelvinDec 16
@thc Literally helping with a task I have right now. Thank you!
Show threadSentry23Dec 16
@thc Awesome work!
Show threadFrederik Braun �Dec 16
@thc is there a write-up on how the collection was performed? Is this IPv4 -> Domain and back based on enumerating all IP addresses or do you go through other sources e.g., CT logs?
Show threadThe Hacker‘s ChoiceDec 16
@freddy it’s sourced by many methods, CT stream is one of the big data inputs (but also where most of the rubbish comes from - which we try to filter out before adding to the database).
Show threadMessedeDec 16
@freddy
1. Certificate transparency logs
2. Reverse DNS lookups
3. Commoncrawl indexes
4. ICANN CZDS root files
.... And friends of course
Show threadFrederik Braun �Dec 16
@messede thanks for the detailed response. That almost deserves its own doc somewhere. :) impressive collection.
Show threadV Carnage, 六七Dec 16
@thc immediately found customer names of an IT contractor type of company. because customer names in subdomains are fine. this is fine.
Show threadEli the BeardedDec 16

@thc

How does it find domains? Missing quite a few from my wildcard site. Maybe wildcard DNS is how to stay invisible?

Show threadThe Hacker‘s ChoiceDec 16
@elithebearded
Yes. Wildcards may help to hide them a bit longer. We find sub domains by various methods. CT stream is one but also searching other places…or user feedback:
Show threadEli the BeardedDec 16

@thc

Probably not going find many of mine like that.

https://pizza-ip.on-a.pizza/

IP.THC.ORG - Reverse-DNS, Subdomain and CNAME Lookups

Reverse-DNS, Subdomain and CNAME Lookups

Show threadChilly  🛡️  Dec 16
@thc
Siicckk
Show threadUSBeeDec 16
@thc how do you fund this?
Show threadThe Hacker‘s ChoiceDec 16
@usbee trough your donations ❤️
Show threadUSBeeDec 16
@thc I can hazzz mor than buy me a coffee?
Show threadlabriaDec 17
@thc running that gets you a redirect to https %(
Also, opening the link in the browser shows a bunch of terminal control chars...
Show threadLucDec 20

@thc first subdomain I put in, it doesn't know. Will it now know it next month? xD

It's in CT logs btw, not secret at all (of course; it's in dns after all)

Show threadextencil Dec 25

@thc, nice! 🔥

I built a lightweight Go client for the IP and Domain dataset to simplify large-scale queries and automation. It focuses on Go's speed and low memory usage.

 https://github.com/haltman-io/ip-thc