nslookup an ip address. some issues!!! and python script required

Question

i do nslookup for this ip..

nslookup 74.125.225.79

and the hostname is given as:

Host Name : ord08s07-in-f15.1e100.net

--

but when i browse to 74.125.225.79 or using the ord08s07-in-f15.1e100.net

it takes me to google.com

I understand that it is a redirect.

--

Question is.. what command can I use on a command line (or with in a python script) to loop through the several ip address that I have in a text file so that I can get directly to the final domain name.

74.125.225.79 -> www.google.com (or something like that) rather than some server name... like ord08s07-in-f15.1e100.net

The reason I need is that... i have a list of several ip addresses from a log file that our users browsed and I need to find out which sites they went... mapping the ip to the domain name that they see on the browser.

I have a python script that loops through the file with the following command:

>>> import socket
>>> socket.gethostbyaddr("69.59.196.211")
('stackoverflow.com', ['211.196.59.69.in-addr.arpa'], ['69.59.196.211'])

But I need the final destination as seen on the browser.

Answer 1

In practical terms, you can't. As you've discovered, a single IP address does not uniquely identify a web site -- a single web site (especially a large one like Google) may have many IP addresses, and a single IP address may be shared by many web sites.

Answer 2

You can't necessarily translate IP addresses to specific web sites, for a number of reasons.

1. Small web sites may use shared servers. The IP resolves to the shared hosting service, not the specific site.
2. Many large site make use of CDNs. These use many servers distributes all around the world.
3. If the web site is hosted on a residential IP, the reverse DNS often points to a name in the ISP's domain, not the customer's own domain.
4. The site might do DNS round-robin load balancing, so www.company.com resolves to several different IPs. The reverse DNS for each of these IPs may be a more specific name, e.g. webserver1.company.com, webserver2.company.com, etc.