-1

When I search something on google.com, I see interaction with the following IP address: 172.217.7.132 network snapshot of google query

But when I attempt to reverse lookup the ip address, I get iad30s08-in-f132.1e100.net. and iad30s08-in-f4.1e100.net., not google.com.

What do I need to do in order to correctly identify that this IP address is resolved by google.com.

EDIT

Clarifying the question: My problem is not specific to google.com. I want to programmatically/logically arrive at google.com because that's what my browser requested for.

Same problem exists in the case of amazon: The IP address it resolves to, on reverseDNS gives me: server-13-32-167-140.sea19.r.cloudfront.net. instead of amazon.com

Code for performing reverse lookup: In [1]: def reverse_lookup(ip_address): ...: from dns import reversename, resolver ...: domain_address = reversename.from_address(ip_address) ...: return [answer.to_text() for answer in resolver.query(domain_address, "PTR")]

Lelouch Lamperouge
  • 8,171
  • 8
  • 49
  • 60
  • Your edit isn't really making things clearer. You can't tie an IP to a single hostname like this, really; a single IP may handle many domains. You could try `dig google.com` to get a list of IPs, but with large sites different geographic locations may see entirely different IP addresses, and they may change regularly. – ceejayoz Oct 24 '18 at 19:30
  • Multiple domains being returned for an IP isn't a problem. Ultimately `google.com` should be a part of the domain list (along with `*.1e100.net`). No? Changing regularly isn't a problem either, I am just trying to understand a situation from one computer at a single instance of time. – Lelouch Lamperouge Oct 24 '18 at 19:35
  • There is not, to my knowledge, a built-in way to discover that `172.217.7.132` corresponds to `google.com`. There are third parties that *attempt* to track these relationships, like http://reverseip.domaintools.com/, but as it's built on crawling domains it's never going to be anywhere near perfect. (I put `172.217.7.132` in there and it didn't have results, for instance.) – ceejayoz Oct 24 '18 at 19:40
  • Thanks @ceejayoz – Lelouch Lamperouge Oct 24 '18 at 19:41

2 Answers2

2

As others have mentioned, 1e100.net does, in fact, belong to google. Their reverse DNS is going to resolve to whatever they want it to resolve to, and there's not much you can do about that.

Depending on your requirements, another alternative may be using a geolocation database to gather more information about an IP. You can find a demo of this here:

https://www.maxmind.com/en/geoip-demo (enter your example address 172.217.7.132 in the form)

MaxMind has various products (some free, some commercial), so one of them may fit your needs of being able to look up this info programatically.

A different possible solution would be to get access to a WHOIS API, such as:

https://hexillion.com/whois

Example results:

https://hexillion.com/samples/WhoisXML/?query=172.217.7.132&_accept=application%2Fvnd.hexillion.whois-v2%2Bjson

guzzijason
  • 144
  • 3
  • I think the critical aspect that you've mentioned here is that the reverse record need not have the same content as the forward record. Thanks. That solves my problem. – Lelouch Lamperouge Oct 26 '18 at 04:42
0

https://support.google.com/faqs/answer/174717

1e100.net is a Google-owned domain name used to identify the servers in our network.

Following standard industry practice, we make sure each IP address has a corresponding hostname. In October 2009, we started using a single domain name to identify our servers across all Google products, rather than use different product domains such as youtube.com, blogger.com, and google.com.

Typically, you will get a 1e100.net result when you do a reverse lookup on one of their IPs. Consider it as good as a google.com result would be - you've verified that the IP is controlled by Google if you see it.

One exception to this is the Googlebot crawler, which may return google.com or googlebot.com results. (I would expect this to eventually get moved over to 1e100.net in the future.)

Community
  • 1
  • 1
ceejayoz
  • 176,543
  • 40
  • 303
  • 368
  • Updated the question for clarity. My question is about how do I get to `google.com` when I start from `172.217.7.132`. Similar logic can be applied to `amazon.com` – Lelouch Lamperouge Oct 24 '18 at 19:12
  • 1
    @LelouchLamperouge You don't, as far as reverse lookups go. `1e100.net` means it's a Google IP. It stops there. – ceejayoz Oct 24 '18 at 19:22