2

How can I determine that accessing to cloudfront.net is associated to which service, software or owner?

(as far as I understand and the normal who-is lookup tells, it is related to Amazons' cloud hosting service, but to which customer or content publisher?)

In other words is there a whois query service telling that for example access to iii-ppp-aaa-ddd.locNN.r.cloudfront.net are associated with the update service of software-X-Y-Z or related to listening online music from music sharing service-A-B-C?

Improve this question

1 Answer 1

Reset to default
3

The IP addresses associated with *.cloudfront.net hostnames do indeed have the format you described:

iii-ppp-aaa-ddd.locNN.r.cloudfront.net

For example:

server-13-32-14-48.muc51.r.cloudfront.net

However, the mappings from distribution hostnames to the underlying IP addresses is not 1:1. The IP addresses returned for any dxxxexample.cloudfront.net hostname (they always start with d for web distributions) are not unique to that hostname.

In the example, above, the only information you can learn from this hostname is muc51, which indicates that the request will be handled by a Munich, DE edge location. (The 51 is a numeric but opaque identifier that apparently has no direct, semantic, external meaning.)

There is no correlation between IP addresses and hostnames that are served by that IP address, because CloudFront uses SNI and/or the HTTP Host header to determine which site is being requested in almost all cases. (The possible exceptions to this do not merit additional consideration, since it is still not possible to determine who is behind the addresses.)

Note also that the particular IP addresses you'll receive if you do a DNS lookup of a *.cloudfront.net hostname will vary based on your location, when you do the lookup, because CloudFront uses the DNS response to send your browser to a nearby edge.

tl;dr: the identity of the entity controlling the particular *.cloudfront.net hostname is not discoverable.

If you have a security concern or abuse complaint, contact AWS. See https://aws.amazon.com/premiumsupport/knowledge-center/report-aws-abuse/ or https://pages.awscloud.com/Security-Contact.html.

Improve this answer
2
  • great explanation. So the only option I have is to capture the host headers inside HTTP requests to guess the website behind it (which would be impossible for ssl)
    – F.I.V
    Commented Oct 2, 2017 at 13:41
  • 1
    That's pretty much it. With SSL, you should be able to capture the server name identification (SNI), since that's sent by the client in cleartext near the beginning of the SSL handshake.
    – Michael - sqlbot
    Commented Oct 2, 2017 at 15:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .