11

What steps would you take to discover all (or close to all) IP addresses that are currently used by a website? How would you be as exhaustive as possible without calling a website admin and asking for the list of IP addresses? ;)

nslookup works but will vary based on dns server queried.

whois is another good tool.

Dig, not bad.

Let's use Facebook for example. I'm blocking that site for the majority our our company's users, but some are approved for "research". I can not easily use OpenDNS because we all appear to come from the same request IP address. I could change that but don't want to add more vlans than I already have.

I also could use block something like regex facebook1 "facebook\.com" (I'm running a cisco firewall) but that's pretty easy to sidestep.

All that being said, I'm asking about specifically about finding ip addresses for a domain and not for other methods that I can block a domain name.

6 Answers 6

9

After trying out quite a few options I discovered that centralops.net gives an incredible extensive result set for dns using their "Domain Dossier". Anyway, it gave me exactly what I needed to get all the facebook A records (and more).

http://centralops.net/co/.

Feeling like a tool for finally answering my own stale question.

2
  • superb... thanks a lot Apr 22, 2022 at 12:31
  • Amazing answer. This was super helpul. Thank you Oct 12, 2022 at 22:02
8

You cannot do it reliably. Larger sites like Facebook (or Google, etc) are using Anycast for their DNS servers so even if you lookup the domain in Whois to get the authoritative DNS server the responses may change from hour to hour or even query to query depending on which data center they want to serve you from.

For smaller sites, I would do a WHOIS on the domain, then do a NS query on each DNS server listed to get a complete list of all possible DNS servers for that domain. Finally, query each DNS server for the FQDN that you want the IP list for.

3

One way of doing it ( I admit not bulletproof) would be to host -t a domain-name and then do a whois in the RIPE/ARIN database for all of those IPs to get the full net-range belonging to the certain website/company and block all of them.
(whois or http://cqcounter.com/whois/ )

1
2

You can do it reliably, but the list of IP addresses can and will change over time, so you have to do it again from time to time.

For blocking companies with lots of IP addresses, you first need to find their autonomous system number. This is relatively easy; it'll be in the whois record for any of their IP addresses.

These examples use GNU jwhois, which normally appears on Linux systems. You may have to massage the commands slightly for other whois clients.

$ host www.facebook.com
www.facebook.com is an alias for star.c10r.facebook.com.
star.c10r.facebook.com has address 173.252.120.6
star.c10r.facebook.com has IPv6 address 2a03:2880:2130:cf05:face:b00c:0:1
star.c10r.facebook.com mail is handled by 10 msgin.t.facebook.com.

$ whois -h whois.radb.net 173.252.120.6 | grep origin
origin:     AS32934
origin:     AS38621

Make sure it actually belongs to Facebook. If you're blocking a small website that doesn't have their own AS, you don't want to do this, as you'll block other people as well. For instance, not all of the ASNs returned above are actually Facebook's.

$ whois -h whois.radb.net AS32934
$ whois -h whois.radb.net AS38621

Now we know which is Facebook's ASN; let's get their IPv4 address ranges.

$ whois -h whois.radb.net -- -i origin -T route AS32934 | grep route: 

And finally their IPv6 address ranges.

$ whois -h whois.radb.net -- -i origin -T route6 AS32934 | grep route6:

Repeat for all their ASNs, if they actually have more than one.

This is just a demo to show how easily the information can be obtained. You can work these into a script at your convenience. Also note that some of the returned ranges may overlap; how you deal with this is between you and your firewall.

1

This may not be exactly what you're looking for, however I find robtex (http://www.robtex.com/) to be useful for finding ips and ranges used.

1

or you can try http://atsameip.com/

1
  • That's kinda the opposite, it shows all the websites at a given IP (eg many websites hosted by same company) but what OP wants is all the different IPs for a given domain name. For example google.com resolves to many different IPs, just try nslookup / pinging google.com on different computers and you will see different IPs.
    – Bastion
    Aug 27, 2019 at 2:48

Not the answer you're looking for? Browse other questions tagged .