Skip to content

Help: Using DNS/ASN resolver script to find working IP/SNI pairs #923

Open
Open
Help: Using DNS/ASN resolver script to find working IP/SNI pairs#923

Description

@Montazeran8
Montazeran8
opened on May 8, 2026

Hi @Shjpr9 ,

In issue #779, you mentioned a small script that resolves a given domain using a list of DNS servers and then looks up its IP info (ASN, country) via an internal website. You also showed a successful example for deno.com:

Enter the domain: deno.com
Resolver: 217.218.155.155 | 65.97ms
Answer(s):
69.67.170.170
ASN Name:  AMAZON-02

I am in a situation where I need to set up fronting_groups for several domains (like val.town, deno.com, fly.io, huggingface.co), but I face two major problems:

  • DNS is heavily poisoned/misbehaving on my ISP, so I can't reliably resolve IPs.
  • My ISP blocks direct connections to most CDN IPs, so I need to test many IPs to find a workable one.

Your script would be a huge help because it can:

  1. Bypass my ISP's DNS issues by using alternative resolvers.
  2. Tell me the ASN of each IP, so I can pick a benign SNI (like aws.amazon.com for an IP in AMAZON-02).

Could you please share the script (or the method behind it)? Even a minimal version that just prints a few IPs with ASN for a given domain would be enough. If you can't share the script itself, maybe you could give some guidance on how to replicate it (e.g., which DNS servers to use, which IP lookup API it calls). I'd be very grateful for any help.

Thank you!

Activity

  1. Shjpr9 commented on May 9, 2026

    @Shjpr9
    Shjpr9
    on May 9, 2026
    Contributor

    Well, I've uploaded it to Github. Check it out here

    It's a small tool that can help going through this guide

  2. Montazeran8
    closed this as completedon May 9, 2026
  3. Montazeran8
    reopened this on May 9, 2026

  4. Montazeran8 commented on May 9, 2026

    @Montazeran8
    Montazeran8
    on May 9, 2026
    Author

    Hi @Shjpr9,

    Thank you very much for sharing your pyDnsTest script. It works perfectly. I was able to get IPs and ASN information for several domains. Here is a quick summary:

    • huggingface.co: 52.222.136.117, 52.222.136.92, 52.222.136.89, 52.222.136.38 → ASN: AMAZON-02
    • val.town: 216.24.57.1 → ASN: RENDER
    • fly.io: 37.16.18.81 → ASN: FLY
    • deno.com: 69.67.170.170 → ASN: AMAZON-02

    However, when I test those IPs from my network using ping and openssl s_client -connect <IP>:443 -servername <SNI>, none of them are reachable. I get connect:errno or write:errno=10054, and 100% packet loss on ping. The IPs are definitely correct (your script resolves them via alternate DNS), but my ISP seems to block all those CDN ranges completely.

    Is this behavior expected? In other words, are those IPs globally valid but simply blocked by my provider? And is there any other tool or approach you would suggest to make fronting_groups work under such restrictive network conditions, or is it basically impossible for me?

    Thanks again for your help!

  5. Shjpr9 commented on May 9, 2026

    @Shjpr9
    Shjpr9
    on May 9, 2026
    Contributor

    Hey there, @Montazeran8
    The only domain maybe you can front is huggingface.co because it's on the Amazon's edge. You must find another Amazon hosted domain which is whitelisted. Then try fronting it with config.fronting_groups.example
    chat.deepseek.com IS on the Amazon's edge, but when I tried, it didn't work. You may find other whitelisted domains which are on the same subnet 52.222.0.0/16 as hugging face which I couldn't yet

  6. Montazeran8 commented on May 9, 2026

    @Montazeran8
    Montazeran8
    on May 9, 2026
    Author

    Hi @Shjpr9,

    Thanks for the explanation. I followed your suggestion and tested react.dev with your getIp.py script (output attached). It's also on AMAZON-02 and opens fine from Iran. The openssl s_client -connect 76.76.21.98:443 -servername react.dev test was successful and returned a valid certificate.

    Now I'm wondering:

    • Since huggingface.co returns IPs like 52.222.136.89 (within the 52.222.0.0/16 range) and react.dev uses IPs like 76.76.21.98 (a different AWS range), can I still use react.dev as the SNI to front huggingface.co?
    • Or must I find a domain whose IP falls exactly within that same 52.222.x.x range?

    Thanks again for your help!

  7. Montazeran8 commented on May 9, 2026

    @Montazeran8
    Montazeran8
    on May 9, 2026
    Author

    @Shjpr9 - You tested these two before?

    www.coursera.org → AMAZON-02
    nextjs.org → AMAZON-02

  8. Shjpr9 commented on May 10, 2026

    @Shjpr9
    Shjpr9
    on May 10, 2026
    Contributor

    Based on my tests, I can confirm that it would have a higher chance for a website to open when its ip address is on on of the whitelisted ip range.
    I'll give an example:

    nextjs.org with ip 216.230.86.129 as you mentioned, can be used to front

    www.tldraw.com with ip 216.150.16.1.

    The subnet network is too large as you can see /8, but there is no guarantee that it will work 100% but the chances are higher.
    Btw, it seems that tldraw website still cannot be loaded due to a failure on resources loading. However the main idea still works

  9. therealaleph
    added a commit that references this issue on May 15, 2026

    feat(fronting-groups): expand vercel/fastly, add github-central/alive…

    c7472aa
  10. dazzling-no-more
    added a commit that references this issue on May 15, 2026

    feat(fronting-groups): expand vercel/fastly, add github-central/alive…

    a018082
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions