Knowing how to find the IP address of a website is one of those small skills that unlocks a lot of larger ones: checking whether DNS has propagated, diagnosing why a site is slow from one region, confirming that a suspicious link resolves where it claims to, or simply finding out where a competitor hosts. Most guides stop at a single nslookup command. This one goes the full distance: resolve the domain, understand why the answer is often a CDN rather than the origin, and then geolocate the address to learn where the site actually lives and on whose network.
Three Ways to Find the IP Address of a Website
Pick whichever fits the moment. All three ask the same question of the DNS system.
Domain Name to IP Address With nslookup and dig
On Windows, macOS or Linux, nslookup is already installed:
nslookup example.com
On macOS and Linux, dig gives a cleaner answer and lets you ask for exactly what you want. The +short flag prints just the addresses; AAAA asks for the IPv6 record instead of the IPv4 A record:
dig +short example.com A
dig +short example.com AAAA
To get an IP from a domain in the browser without a terminal, any public DNS lookup page does the same thing, and most show the full record set including mail and name servers.
How to Find an IP Address From a URL With Subdomains and Paths
DNS knows nothing about paths or query strings, so https://shop.example.com/products?id=1 resolves on shop.example.com alone. Strip the scheme and everything after the first slash, and note that a subdomain can point somewhere entirely different from the bare domain: example.com may sit on one host while shop.example.com is a hosted storefront on another provider’s infrastructure. Always resolve the exact hostname in the URL.
From a Script
Every language has a one-liner. Python’s is socket.gethostbyname(“example.com”); for all addresses including IPv6 use socket.getaddrinfo. In PHP it is gethostbyname(). In Node, dns.promises.resolve4() and resolve6().
Why You Get Several IPs, or the Wrong One: CDNs, Anycast and Load Balancers
Run dig on a large site and you will often get four, eight or more addresses. That is not an error. Sites publish multiple A records for redundancy, and clients pick one. You may also notice that the answer changes when you run it from a different country, which is anycast at work: one address announced from many locations, with routing sending you to the nearest.
The bigger surprise for many people is that the address belongs to a content delivery network or a DDoS protection service rather than to the site’s owner. If a domain is behind Cloudflare, Akamai, Fastly or a cloud load balancer, the IP you get is the edge that fronts the site. Geolocating it tells you where that edge node is, which is usually close to you, not where the origin server is.
How to Find the Server IP Address Behind a CDN (and When You Cannot)
Sometimes you genuinely need the origin: you are migrating a site and want to confirm the old host, or you are investigating whether a phishing page is served from the same box as another one. There are legitimate clues, and there is a point past which the answer is simply not public.
- Look at other records. Mail servers (dig MX), FTP or direct. style subdomains are often left pointing straight at the origin even when the main hostname is proxied.
- Check historical DNS. Passive DNS archives record what a domain resolved to before it moved behind a CDN.
- Read response headers. A Server header or a platform-specific header can name the hosting provider even when the IP does not.
- Accept the limit. A correctly configured CDN with origin protection exposes nothing, and that is by design. Techniques for forcing origin disclosure move quickly into abuse, so stop at the public record.
From IP to Hosting Location: Running the Address Through an IP Lookup API
Once you have an address, the interesting question is what it belongs to. Feeding it into an IP lookup API returns the country and city where that address is routed, plus the network operator and its ASN. That combination answers “where is this hosted” in a way DNS never can. A response for a typical cloud-hosted site looks like this:
{
“ip”: “203.0.113.10”,
“country_name”: “Germany”,
“city”: “Frankfurt am Main”,
“connection”: { “asn”: 16509, “isp”: “Amazon.com, Inc.” }
}
Two readings follow immediately. The ASN belongs to a cloud provider, so this is a rented server, not a company’s own data center. And Frankfurt is the region the operator chose, which matters for latency if your users are in Asia, and for compliance if the site promises EU data residency.
IP Address to Hostname: Checking the Reverse Record
The reverse direction is a quick sanity check. dig -x 203.0.113.10 performs an IP address to hostname lookup via the PTR record, and a hostname lookup by IP on a cloud address typically returns a provider-generated name such as ec2-…compute.amazonaws.com, confirming the hosting guess. Reverse records are optional and often missing, so treat an empty answer as “unknown,” not “hidden.”
Reading the Result: Three Common Patterns
After running a few dozen domains you will see the same three shapes. A cloud ASN (AWS, Google, Azure, Hetzner, DigitalOcean) with a city that matches a known region means a self-managed deployment; the region tells you their primary market. A CDN or edge ASN (Cloudflare, Akamai, Fastly) with a city near you means the origin is hidden and the location is meaningless for hosting purposes; stop there or use the clues above. A registration in the company’s own name, often with a city matching their head office, means on-premises or colocated hosting, which is increasingly rare and worth noting in a migration audit because it usually implies a longer cutover.
Script: Resolve and Geolocate a List of Domains
For a migration audit or a competitor survey, do it in bulk. This Python script reads domains from a file, resolves each one, and looks up the hosting location and network for the first address returned:
import os, socket, sys, requests
KEY = os.environ[“IPSTACK_KEY”]
def resolve(domain):
try:
return socket.gethostbyname(domain)
except socket.gaierror:
return None
def locate(ip):
r = requests.get(f”https://api.ipstack.com/{ip}”,
params={“access_key”: KEY, “fields”: “country_code,city,connection”},
timeout=5)
d = r.json()
if “error” in d:
return None
return d
for domain in open(sys.argv[1]):
domain = domain.strip()
if not domain:
continue
ip = resolve(domain)
if not ip:
print(f”{domain}tunresolved”)
continue
d = locate(ip)
if not d:
print(f”{domain}t{ip}tlookup failed”)
continue
print(f”{domain}t{ip}t{d[‘country_code’]}t{d.get(‘city’)}t{d[‘connection’][‘isp’]}”)
Run it with python hosted.py domains.txt and you get a tab-separated table you can paste into a spreadsheet. The endpoint used here has a free tier, so an ipstack API key is enough to run it on a few hundred domains without cost.
FAQ
Why does a website’s IP address change?
Because the site moved hosts, added a CDN, or uses DNS-based load balancing that rotates answers. Large sites also return different addresses to different regions on purpose. Only the current DNS answer is authoritative; cached results in your operating system or browser can lag for the duration of the record’s TTL.
Is the hosting location the same as the company’s location?
Usually not. A company registered in one country commonly hosts in another, often wherever its cloud provider had a region close to its users. Hosting location tells you about infrastructure and data residency, not about where the business operates.
About the author: Shubham Chauhan writes about IP data, web infrastructure and developer tooling for the team at ipstack, a real-time IP geolocation API used by more than 200,000 companies to locate visitors, personalize experiences and detect fraud.
