从 IP 地址获取 gTLD 或 ccTLD

Question

There are many questions on SO related to fetching an IP address from URL, but not vice versa.

As the title suggests, I would like to get the website URL of its respective IP address. For instance:

>>> import socket
>>> print(socket.gethostbyname('google.com'))

This looks up the domain and returns 172.217.20.14 . I am looking for the counter part like eg:

>>> print(socket.getnamebyhost('172.217.20.14'))

Anything similar that would return the domain as google.com for the IP specified.

Is this possible to do in python3? If yes, how can this be achieved?

---

UPDATE

Unfortunately, the way I'm approaching this is wrong. There are IPs that share a one-to-many relationship ie the nameserver points to numerous urls, unless the PTR record indicates otherwise. My question rephrased:

How do IP-to-domain data providers like ipinfo.io return top-level domains for a single IP?

To my understanding, the A or AAAA records play an important role, but the only thing I get from these are ns rather than the domain. I don't know how to extract the gTLD or ccTLD from the records. I'm open to any suggestions, if anyone is willing to share an answer on how to parse gTLD(s) or ccTLD(s) from any IP. Preferably in python, but a shell script would also suffice.

Answer 1

The socket.gethostbyaddr('172.217.20.14'), would be the right way to go here, but not necessarily. Here's why:

Domain to IP resolution goes like:

domain > root server > origin server > origin server's hostname to IP configurations.

Now to reverse engineer it, we have to take into account:

1. There can be multiple domains sharing that same IP address as is the case with shared hosting.

2. Assuming the domain has dedicated IP, the nslookup or gethostbyaddr 'should' return the domain name, but there can be proxy servers in-front, like Cloudflare and whatever Google is using.

So even if you do this manually like try to find out actual IP google's server is running on you cannot, as that would open their central server for all kinds of attacks, most importantly DDoS.