3

I am very curious if it is possible to find the real IP address of a domain "protected" by a CDN service.

For example, www.cnn.com uses Fastly service, and the domain name only resolves to a Fastly edge server's IP. If I scan the whole 4 billion IP range, sending HTTP GET request with header Host: www.cnn.com, how possible it will be that I can find the real IP of cnn's origin server?

Improve this question

3 Answers 3

Reset to default
4

There is no need to scan the whole IPv4 space. Completely wasteful. If you already know the CDN, then you can easily find the ASN and all the IP ranges under that AS. Very large organizations may run more than one ASN but you have tools like Robtex to explore further. (BTW an IP range may also be announced by more than one ASN).

The answer is maybe. It depends on how the webserver was configured, in particular if there are remnants of the past (pre-CDN era) in the configuration. A properly-configured webserver under a CDN should not respond to direct requests made outside of the CDN.

Better yet, the webserver could have ports 80/443 open only for specific IP ranges (those belonging to the CDN), so the ports would appear closed on your end while scanning since your IP address is not among those whitelisted.

My advice would be to read the documentation applicable to that particular CDN, then you can test if the server in question followed all recommendations. The CDN may already be doing a lot but it's important to understand what the CDN does and does not (or cannot do).

Improve this answer
4
  • While I knew scanning the whole 4 billion is not necessary, I was thinking narrow it down according to, e.g., country code or so. How can you find an AS according to a CDN, using the same example, cnn.com uses Fastly, then how do I know which AS cnn.com belongs to?
    – SamTest
    Feb 22, 2020 at 15:30
  • SamTest: here is a starting point using an IP address that cnn.com resolves to: bgp.he.net/ip/151.101.1.67
    – Kate
    Feb 22, 2020 at 15:41
  • Anonymous: yes Fastly belongs to this AS, but does it mean CNN must also belongs to this AS? If Fastly does not deploy edge servers in a certain AS, does it mean all the hosts in that AS will not be able to use Fastly's service?
    – SamTest
    Feb 25, 2020 at 14:12
  • 2
    If you run dig -t a cnn.com you'll get 4 IPv4 addresses for CNN.com, in the same /16 group. If you check each IP address at bgp.he.net for example, you'll see they are all announced by AS54113, additionally there is one of those four that is also announced by AS28634, another AS. So the next step is to collect all the IP ranges from those two AS and take it from there. The question is not whether CNN 'belongs' to some AS. Actually, they could even have their own separate AS. The fact is that they are using a service provider on that AS54113 (plus AS28634). That's where you should be looking.
    – Kate
    Feb 25, 2020 at 17:44
4

Probably not.

  • CNN could be using a push CDN (where data is sent to the CDN) instead of a pull CDN (where it downloads from a central server).
  • Fastly also provides hosting services, so CNN could just be using them directly.
  • If CNN does run their own servers, they probably have firewalls in place so that their servers only answer requests from fastly.
  • And finally, some webservers are probably going to answer any request, without checking the domain first, so you'd have to sort out the "real" CNN from all the other servers that just happen to answer to any name.
Improve this answer
-2

Yes, It is possible. You can find the real IP of a domain. It's a little difficult but possible. There are many tools available online:

  • Censys
  • Shodan
  • Nmap
  • etc.
Improve this answer
2
  • 2
    None of those tools will do what the OP asked. Could you explain how those tools would accomplish the task?
    – schroeder ♦
    Feb 22, 2020 at 9:33
  • Yes, Shodan can do it if the website didn't configure an IP whitelist. For example, here is a tool that uses Shodan's favicon data to get the real IP of a server behind a CDN: github.com/pielco11/fav-up
    – achillean
    Feb 25, 2020 at 17:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .