How can I find out what website someone is going to from the destination ip address?

Question

How can I find out what website someone is going to from the destination ip address e.g. http://199.239.137.32/

Solution 1

No. Ever since HTTP 1.1, it is possible to host more than one domain at any given IP address, and it is therefore not possible given just the IP address to work out which particular website belongs to that IP address.

What you can do however is do a reverse DNS lookup on the IP address (the easiest thing to do if you're a windows user is to open cmd.exe and ping 1.2.3.4 and it'll reverse-DNS lookup the ip address for you as the top most entry). This will tell you the DNS name of the IP address that will give you some indication.

Secondly you can always just visit the IP address. Type it into your browser as http://1.2.3.4 and you'll be taken to the website at that address if there is a default one on port 80. If you're suspicious of the content of the website you should be careful, as it may not be safe-for-work!

Finally if you have a wireshark network capture of the traffic going to the IP address, you'll be able to see the specific details of which URLs, websites and queries happened on the website, which may be of a more specific interest to you if you are auditing a specific user's activity, for instance whilst investigating misuse of company time or equipment.

Solution 2

You cant

IP Addresses do not carry referrer information.

Browsers pass context around that contain URL referrers, browser types, query parameters etc etc.

The only thing you can do is trace its location and some whois information.

For example using the tools at

http://itools.com/internet

To find out more information of a visitor to your website you would use server side techniques or client side scripts.

PHP

$referringSite = $_SERVER['HTTP_REFERER'];

.NET

Dim referringSite as String = Request.ServerVariables["HTTP_REFERER"]

JavaScript / jQuery

var referringSite = document.referrer;

Comments

[MSalters]

It is quite possible that the IP address is a web proxy, not a web site. On the outside, that looks quite similar.

[MSalters]

If you're in a position where you are allowed to check where "someone" is going to, then accidentily visting NSFW sites is an unavoidable risk. Cf. police officers walking into crime scenes.

[SecurityMatt]

There is a difference between knowing that someone is visiting dodgy websites and actually seeing the dodgy websites for yourself. If you can find out that someone has broken company rules without subjecting your eyes to what precisely they were up to, then you might be able to sleep better that night.

[MSalters]

Indeed, which is why I call it a "accident/risk" instead of "unavoidable part of the job".

[user3540003]

-1: Referrers don't have anything visibly to do with the question.

[Spiff]

I agree with @KevinReid. A referrer is the website you last visited, that had the link to the website you're trying to get to now. It's not necessarily the same as the website you're trying to get to now (unless you're clicking on links between pages on the same site).