Can several domain names use the same IP address?¶
title: "Can several domain names use the same IP address?" card_id: "IP-040" status: "complete" source_document: "https://docs.google.com/document/d/1FUHwG4OXIhUWoR-knmFpePFowjw2bv3RntNjYtP12S8/edit?usp=drivesdk"
Can several domain names use the same IP address?¶
Several different domain names can use the same IP address.
This is extremely common.
A hosting provider may operate one server for dozens, hundreds or even thousands of websites.
When a connection reaches that server, the server needs another way to determine which website the user wants.
For ordinary web traffic, the browser includes the requested hostname as part of the communication.
With encrypted web connections, a mechanism called Server Name Indication—usually shortened to SNI—can also indicate which named service the client is trying to reach.
The shared server, reverse proxy or hosting platform uses that information to send the request to the correct website.
This means that one IP address can act as the entrance to many different services.
Content-delivery networks work in a similar way.
A CDN may provide shared front-end infrastructure for large numbers of unrelated organisations. Many domain names can therefore resolve to addresses operated by the same CDN.
Cloud platforms, website-building services and security providers may also place numerous customers behind shared addresses.
Finding that a domain name used an IP address doesn't mean that the address was dedicated to that domain.
It also doesn't mean that every connection to the address was a connection to that particular website.
Imagine that fifty websites share the same address.
A network record showing only a connection to that IP address may establish that the device contacted the shared infrastructure. Without additional information, it may not establish which of the fifty websites was requested.
The destination port might indicate the type of service, such as encrypted web traffic, but it won't normally distinguish between all the websites using that service on the same address.
Information such as the requested hostname, URL, SNI value, DNS activity or records held by the hosting service may help distinguish the intended destination.
Reverse-IP lookup services sometimes attempt to list domain names associated with an address.
Those lists aren't necessarily complete or current. They may include historical associations, miss domains or show names that were configured but never meaningfully used.
The IP address may also have been reassigned or its hosted services changed since the recorded event.
A shared IP address identifies common infrastructure. It doesn't automatically identify the particular domain, website or content involved.
To establish the named service, the IP address may need to be combined with information from the original connection or application record.