How IP Tracking Works

The technology behind tracking domain IP address changes over time

DNS Fundamentals: The Internet's Address Book

The Domain Name System (DNS) is the backbone of how the internet translates human-readable domain names into machine-readable IP addresses. When you visit a website, your browser performs a DNS lookup to find the IP address associated with the domain name. This process involves querying a hierarchy of DNS servers, starting from root servers and working down to authoritative nameservers that hold the actual records.

Two types of DNS records are central to IP tracking:

These records are not static. Website operators regularly change their A and AAAA records when they migrate servers, switch hosting providers, adopt CDN services, or restructure their infrastructure. Each of these changes leaves a trace in passive DNS collection systems.

How Passive DNS Collection Works

Passive DNS (pDNS) is a technique for collecting DNS data by observing DNS query responses as they pass through DNS resolvers and network sensors. Unlike active DNS scanning (where you explicitly query domains), passive DNS captures real-world DNS traffic without generating any additional load on DNS infrastructure.

Here is how the process works:

  1. Observation: Sensors positioned at strategic points in the DNS resolution chain observe DNS query-response pairs. These sensors record which domains resolve to which IP addresses at any given time.
  2. Collection: The observed DNS responses are collected, deduplicated, and stored in a database. Each entry includes the domain name, the record type (A, AAAA, CNAME, MX, etc.), the resolved value, and timestamps.
  3. Aggregation: Data from multiple vantage points can be aggregated to broaden the observed view of DNS resolutions. Even then, sensor and time coverage remain incomplete.
  4. Indexing: The collected data is indexed to enable fast lookups by domain name, IP address, record type, and time range. This indexing is what powers tools like ip-history.net.

The Profundis.io platform powers ip-history.net with a large collection of DNS observations used to investigate internet infrastructure over time.

What IP History Changes Tell Us

Analyzing patterns in a domain's IP history can reveal significant information about its infrastructure and operations. Here are some common patterns and what they indicate:

Hosting Provider Switches

When a domain's IP address moves from one network block to another, it often indicates a hosting provider change. For example, if a domain moves from an IP in the OVH range (e.g., 51.x.x.x) to an IP in the AWS range (e.g., 52.x.x.x), this suggests a migration from traditional hosting to cloud infrastructure. These transitions can be verified by checking the ASN (Autonomous System Number) associated with each IP address.

CDN and DDoS Mitigation Adoption

The adoption of services like Cloudflare, Akamai, or AWS Shield is immediately visible in IP history. When a domain switches from a single IP to Cloudflare's IP ranges (e.g., 104.16.x.x or 172.67.x.x), it indicates the deployment of CDN and DDoS protection services. Similarly, a sudden change away from known CDN ranges might indicate the removal of such protection.

Geographic Infrastructure Changes

IP addresses are announced and operated by networks that GeoIP databases associate with approximate locations. A change from a US-associated block to a European-associated block can suggest a network or delivery-path change, but it does not by itself prove a physical server move, a data-residency decision, or organizational ownership.

Security-Related Changes

Rapid or unexpected IP changes can signal security events. A domain that suddenly changes its IP address multiple times in a short period may be under attack, or the operators may be rotating infrastructure to mitigate ongoing threats. Conversely, a domain that is used for malicious purposes may change IPs frequently to evade blocking and takedown efforts — a technique known as fast-flux DNS.

GeoIP Enrichment and ASN Data

Raw IP addresses become far more valuable when enriched with additional context. IP history tools like ip-history.net enhance results with:

Real-World Examples of Infrastructure Changes

Looking at the IP history of well-known domains reveals interesting patterns:

You can request an observed IP-history sample for a domain using the search on our home page.

Explore Broader DNS Intelligence

While ip-history.net provides a limited observed A/AAAA sample, professional users who need deeper analysis, bulk access, and API integration can explore Profundis.io. The platform adds more DNS record types, advanced filtering, export capabilities, and integration options for security teams and researchers.

Related Resources