[achillean]

We developed "geodns" for situations where you want to do DNS lookups from different regions around the world. For example, ycombinator.com returns different IPs depending on your location:

  $ geodns ycombinator.com
  108.156.133.117                Singapore
  108.156.133.21                 Singapore
  108.156.133.25                 Singapore
  108.156.133.59                 Singapore
  108.156.39.26                  London
  108.156.39.61                  London
  108.156.39.62                  London
  108.156.39.64                  London
  13.32.27.123                   Frankfurt am Main
  13.32.27.47                    Frankfurt am Main
  13.32.27.51                    Frankfurt am Main
  13.32.27.80                    Frankfurt am Main
  13.35.93.12                    Clifton
  13.35.93.14                    Clifton
  13.35.93.46                    Clifton
  13.35.93.47                    Clifton
  18.239.94.100                  Amsterdam
  18.239.94.114                  Amsterdam
  18.239.94.33                   Amsterdam
  18.239.94.79                   Amsterdam
  99.86.20.42                    Doddaballapura
  99.86.20.54                    Doddaballapura
  99.86.20.64                    Doddaballapura
  99.86.20.96                    Doddaballapura

https://gitlab.com/shodan-public/geonet-rs

[metadat]

Is that because it's behind cloudflare? I'm pretty sure it still runs primarily on a single server in a Colo (i.e. except in times of hardware failure or other physical realities).

[oefrha]

You’re thinking about news.ycombinator.com, run on a single server from M5, which is not the same as ycombinator.com.

  > dig +short news.ycombinator.com
  209.216.230.207
  > ipinfo 209.216.230.207
  {
    "ip": "209.216.230.207",
    "hostname": "news.ycombinator.com",
    "city": "San Diego",
    "region": "California",
    "country": "US",
    "loc": "32.7157,-117.1647",
    "org": "AS21581 M5 Computer Security",
    "postal": "92101",
    "timezone": "America/Los_Angeles",
    "readme": "https://ipinfo.io/missingauth"
  }

It was moved to AWS temporarily the last time the servers failed: https://news.ycombinator.com/item?id=32031136

[1vuio0pswjnm7]

It's also possible to get a copy of HN from Cloudflare in addition to M5. I keep historical DNS data and can confirm there are Cloudlfare IPs that continue to work.

[kevin_nisbet]

whois is returning AWS and I don't see any of the normal cloudfront headers, but I do see a server header of nginx. So it doesn't look like cloudflare to me, I'd guess they're just running some ec2 instances with nginx configured to give the exact behaviour they need (as I recall they return cached pages to non logged in users, which is why you can sometimes log out and get the page to load when they're having issues). I also see awsdns in their ns records, so it looks to be like they're just doing Geo-dns in route53 to route to the closest instance they're running.

[1vuio0pswjnm7]

https://geonet.shodan.io/api/geodns/ycombinator.com?rtype=A