cunneen · February 18, 2026 13:40 · cunneen · May 26, 2025
diff --git a/reverseip.sh b/reverseip.sh
 # WARNING: this is brittle as hell. It will break when robtex changes their website.
 #
 # reverseip
 # A shell function to get a list of domain names associated with the given IP address, using Robtex.com
 #
 # Parameters:
 #   IP - IP address to reverse lookup
 #
 # Returns:
 #   List of domain names associated with the IP address
 #
 # Requires:
 #   curl
 #   jq
 #
 function reverseip() {
  local IP=${1} # IP address as first parameter

  # How this works:
  # 1. Use curl to get the HTTP response body from https://robtex.com/neo/dsn/es/https/robtex.com/en/ip-lookup/${IP}
  # 2. The HTTP response body returned by Robtex is a plain-text data file for the IP address.
  #    We attempt to parse it to extract all the domain names using awk, sed and jq.

  # print usage if no IP address is given, or --help is given
  if [[ -z "${IP}" || "${IP}" == "--help" ]]; then
    echo "Usage: reverseip [IP]"
    echo "Parameters:"
    echo "  IP - IP address to reverse lookup"
    echo "Example:"
    echo "  reverseip 207.204.43.124"
    return 0
  fi

  # check for dependencies
  command -v curl >/dev/null 2>&1 || {
    echo "reverseIP: curl is required" >&2
    return 1
  }
  command -v jq >/dev/null 2>&1 || {
    echo "reverseIP: jq is required" >&2
    return 1
  }
  local CURLPATH=$(which curl)
  # ==== complex parsing rules ====
  # Used to convert an IP address to a Robtex lookup URL component e.g. "207.204.43.124" becomes "207/204/43/124"
  local SED_IP_WITH_SLASHES='s/\./\//g'
  # Used to parse the Robtex data file, extracting the data from the line immediately following "id:21"
  local AWK_PARSE_ROBTEX_DATA_OUTPUT='/^id:[[:digit:]]+\ndata: \{"content":/{gsub(/^id:[[:digit:]]+\ndata: /,"",$0); gsub(/\>\</,"\>\\n\<",$0); print $0;}'
  # Extracts the domain names from the HTML data
  local SED_TIDY_ROBTEX_LINKS='s/^\<a href=\\?"https:\/\/robtex\.com\/en\/dns-lookup\/[^"]*\\?"\>(.+)\<.*$/\1/gp'
  # Joins the domain names parts together, where there's a line ending in a dot
  local AWK_JOIN_ROBTEX_DOMAIN_NAME_PARTS='/\.\n([^\n]+)/{gsub(/\.\n/,".",$0); printf("%s\n",$0);}'

  # ==== main logic ====
  echo ${IP} |
    sed "${SED_IP_WITH_SLASHES}" |
    xargs -I % "${CURLPATH}" -s https://robtex.com/neo/dsn/es/https/robtex.com/en/ip-lookup/% 2>&1 |
    awk -v RS="\0" -v ORS="" "${AWK_PARSE_ROBTEX_DATA_OUTPUT}" |
    jq -r '.content' |
    sed -n -E -e "${SED_TIDY_ROBTEX_LINKS}" |
    awk -v RS="\0" -v ORS="" "${AWK_JOIN_ROBTEX_DOMAIN_NAME_PARTS}" | 
    sort -u
 }
	# WARNING: this is brittle as hell. It will break when robtex changes their website.
	#
	# reverseip
	# A shell function to get a list of domain names associated with the given IP address, using Robtex.com
	#
	# Parameters:
	# IP - IP address to reverse lookup
	#
	# Returns:
	# List of domain names associated with the IP address
	#
	# Requires:
	# curl
	# jq
	#
	function reverseip() {
	local IP=${1} # IP address as first parameter

	# How this works:
	# 1. Use curl to get the HTTP response body from https://robtex.com/neo/dsn/es/https/robtex.com/en/ip-lookup/${IP}
	# 2. The HTTP response body returned by Robtex is a plain-text data file for the IP address.
	# We attempt to parse it to extract all the domain names using awk, sed and jq.

	# print usage if no IP address is given, or --help is given
	if [[ -z "${IP}" \|\| "${IP}" == "--help" ]]; then
	echo "Usage: reverseip [IP]"
	echo "Parameters:"
	echo " IP - IP address to reverse lookup"
	echo "Example:"
	echo " reverseip 207.204.43.124"
	return 0
	fi

	# check for dependencies
	command -v curl >/dev/null 2>&1 \|\| {
	echo "reverseIP: curl is required" >&2
	return 1
	}
	command -v jq >/dev/null 2>&1 \|\| {
	echo "reverseIP: jq is required" >&2
	return 1
	}
	local CURLPATH=$(which curl)
	# ==== complex parsing rules ====
	# Used to convert an IP address to a Robtex lookup URL component e.g. "207.204.43.124" becomes "207/204/43/124"
	local SED_IP_WITH_SLASHES='s/\./\//g'
	# Used to parse the Robtex data file, extracting the data from the line immediately following "id:21"
	local AWK_PARSE_ROBTEX_DATA_OUTPUT='/^id:[[:digit:]]+\ndata: \{"content":/{gsub(/^id:[[:digit:]]+\ndata: /,"",$0); gsub(/\>\</,"\>\\n\<",$0); print $0;}'
	# Extracts the domain names from the HTML data
	local SED_TIDY_ROBTEX_LINKS='s/^\<a href=\\?"https:\/\/robtex\.com\/en\/dns-lookup\/[^"]\\?"\>(.+)\<.$/\1/gp'
	# Joins the domain names parts together, where there's a line ending in a dot
	local AWK_JOIN_ROBTEX_DOMAIN_NAME_PARTS='/\.\n([^\n]+)/{gsub(/\.\n/,".",$0); printf("%s\n",$0);}'

	# ==== main logic ====
	echo ${IP} \|
	sed "${SED_IP_WITH_SLASHES}" \|
	xargs -I % "${CURLPATH}" -s https://robtex.com/neo/dsn/es/https/robtex.com/en/ip-lookup/% 2>&1 \|
	awk -v RS="\0" -v ORS="" "${AWK_PARSE_ROBTEX_DATA_OUTPUT}" \|
	jq -r '.content' \|
	sed -n -E -e "${SED_TIDY_ROBTEX_LINKS}" \|
	awk -v RS="\0" -v ORS="" "${AWK_JOIN_ROBTEX_DOMAIN_NAME_PARTS}" \|
	sort -u
	}
No results found