viewdns.info

Accounts used so far: 6 (1500 reverse IP checks).

Their historic DNS and reverse DNS info was very valuable, and served as Ciro's the initial entry point to finding hits in the IP ranges given by Reuters.

Their data is also quite disjoint from the data of the 2013 DNS Census. There is some overlap, but clearly their methodology is very different. Some times they slot into one another almost perfectly.

You can only get about 250 queries on the web interface, then 250 queries per free account via API.

Since this source is so scarce and valuable, we have been quite careful to note down all the domain and IP ranges that have been explored.

They check your IP when you signup, and you can't sign in twice from the same IP. They also state that Tor addresses are blacklisted.

At news.ycombinator.com/item?id=38496244, the creator of the viewdns.info, "Hughesey", also stated that he'd able to give some free credits for public research projects such as this one. This would have saved up going to quite a few Cafes to get those sweet extra IPs! But it was more fun in hardmode, no doubt.

They also normalize dots in gmail addresses, so you need more diverse email accounts. But they haven't covered the .gmail vs .googlemail trick.

We do API access to IP ranges with this simple helper: cia-2010-covert-communication-websites/viewdns-info.sh, usage: e.g.:

For domain to IP queries from the API you should use "iphistory" viewdns.info/api/docs/ip-history.php:

Very curiously, their reverse IP search appears to be somewhat broken, or not to be historic, e.g.We've contacted viewdns.info support and they replied:

The reverse IP tool will only show a domain if that is it's current IP address.

This is likely not accurate, more precisely it likely only works if it was the last IP address, not necessarily a current one.