How We Trace Domains Across Changing IP Addresses

A website’s IP address can look stable from a user’s perspective while changing behind the scenes. Hosting providers move services between servers, content delivery networks select different edges, and Internet Service Providers update routing or DNS records. A single address can also serve hundreds or thousands of unrelated domains.

That creates a measurement problem for censorship research. Blocking an IP address may affect one domain, several domains, or an entire shared hosting platform. Conversely, a domain can appear reachable from one Australian network and unavailable from another because each ISP uses different DNS resolvers, filtering equipment, routes, or cached records.

Net Neutrality Monitor treats an address as evidence to investigate, not as a permanent identity for a website. The system combines domain names, DNS responses, probe locations, timestamps, and observed connection behaviour to separate a likely website-specific block from wider collateral impact.

Signal	What it can show	Main limitation
DNS response	Whether a resolver returns the expected address	A correct answer does not prove the site is reachable
IP address match	Whether several domains share infrastructure	Shared hosting does not mean shared ownership
HTTP or TLS result	Whether the requested hostname responds correctly	Firewalls may interfere before the request reaches the server
Repeated probe result	Whether an anomaly persists across checks	Network conditions and cached data can change
Country comparison	Whether filtering differs by jurisdiction or provider	Results are indicative rather than a legal finding

Why A Shared Address Needs Careful Analysis

Modern web hosting makes one IP address a poor substitute for a domain name. Virtual hosting allows a server to select content based on the HTTP Host header or the hostname supplied during a TLS handshake through Server Name Indication. The same numerical address may therefore deliver completely different sites to news-example.com, shop-example.net, and community-example.org.

Large platforms add another layer. A domain may resolve to multiple IPv4 and IPv6 addresses, with DNS answers varying by location, time, resolver policy, or traffic load. A content delivery network can direct a visitor in Sydney to a different edge from one in Perth, while both users believe they are visiting the same service.

For that reason, the system records the hostname tested alongside the address observed at the time. It does not automatically label every domain on a shared server as blocked when one domain produces a filtering response.

The Evidence Collected During A Check

A monitoring event can include the queried domain, returned DNS records, resolver identity, probe country, timestamp, and connection outcome. Depending on the test, the result may indicate a normal response, a timeout, a DNS manipulation response, a connection reset, a block page, or a failure unrelated to censorship.

Repeated checks help distinguish a durable pattern from a transient fault. If a domain resolves normally but connections fail only through one provider, that may point to provider-level filtering, routing trouble, or a resolver issue. If several unrelated domains on the same address fail in the same way, the shared address becomes relevant evidence, but it still requires interpretation.

Readers can examine broader findings through the published censorship reports, where country-level and statistical material provides context for individual observations. Results are supplied for indicative research purposes, so a single probe should not be treated as definitive proof of a government order or an ISP policy.

How The System Separates Hostnames From Addresses

The monitoring logic starts with the requested domain, then records the IP addresses returned during resolution. It checks whether the target remains associated with those addresses and compares the observed response with expected web behaviour. A domain-specific test is important because an IP-only check may reach a default server page rather than the intended virtual host.

TLS information can provide another useful signal. A certificate naming one domain, a certificate mismatch, or a failed handshake may reveal that the connection reached an unexpected service. These details do not automatically identify censorship: expired certificates, server misconfiguration, restrictive firewalls, and broken IPv6 can produce similar symptoms.

The system therefore correlates multiple observations instead of treating a matching IP as a final answer. A shared address raises a question about collateral blocking; it does not establish that all associated domains are restricted.

When DNS Changes Make Old Results Misleading

DNS records have a time-to-live, or TTL, that tells resolvers how long an answer may be cached. In practice, caches, resolver policies, and network equipment do not always change at exactly the same moment. A domain can therefore point to an old server for some users while returning a new address for others.

This is particularly relevant for Australian users on the NBN, where households may use ISP-provided DNS, a third-party resolver, or a router configured years earlier. Telstra, Optus, TPG, and smaller providers can expose different DNS paths and filtering implementations. A result captured on a Melbourne connection may not match one from regional Queensland or Western Australia.

Address churn also occurs during outages, migrations, and traffic surges. The system preserves the time associated with an observation so that an old IP relationship is not mistaken for a current one. Historical evidence remains useful, but it must be read as a snapshot of network conditions at that point.

IPv4, IPv6, CDNs, And Shared Hosting

A domain may publish both an A record for IPv4 and an AAAA record for IPv6. Some networks prefer IPv6, while others fall back to IPv4. If only one protocol path is filtered or broken, two people using the same domain can receive different outcomes without any change to the site itself.

CDNs make the address relationship even less direct. An address may be operated by a global delivery provider and shared by domains from many countries. Blocking it at the IP layer could disrupt unrelated businesses, public information services, online shops, and community groups. The risk is especially significant for smaller Australian organisations that use affordable shared hosting rather than dedicated infrastructure.

A comparison of infrastructure signals can also help explain why an address appears in a result. The system can note that multiple names resolve to the same address, but it does not infer that they are controlled by the same publisher. Ownership, hosting, DNS management, and content publication may belong to entirely separate parties.

Reading Results In The Australian Context

Australian access conditions include both technical and regulatory factors. Court-ordered website blocking has operated through Australian ISPs under the Copyright Act, while the Online Safety Act gives the eSafety Commissioner powers in specific online safety contexts. These frameworks do not mean that every timeout or DNS anomaly is an official block, and technical measurements cannot substitute for identifying the legal basis of a restriction.

Local network habits can affect observations too. Many households use ISP-issued routers, mobile broadband, or workplace and school networks with their own DNS settings. A traveller moving from a home connection in Brisbane to hotel Wi-Fi in Sydney may encounter different resolver behaviour, cached answers, and filtering equipment. Regional users can also experience ordinary routing or capacity problems that resemble censorship.

Country comparisons are most useful when they combine several probes and dates rather than relying on one Australian result. The country comparison guide explains how changing outcomes across jurisdictions can reveal broader patterns without collapsing technical uncertainty into a simple blocked-or-available label.

Practical Reading Rules

A result involving a dynamic address should be read as a relationship between a hostname, an address, a network, and a time. The most reliable interpretation comes from recurring evidence across those dimensions. This approach is useful for researchers, journalists, Australian network operators, and users checking whether an access problem is local or widespread.

The same discipline applies when comparing web services used by schools, councils, or community organisations. Open-source deployments and hosted platforms can share infrastructure in ways that make an address-based conclusion unsafe; a school network example illustrates why the service and the underlying network should be considered separately.

Signals that deserve extra checking

• A domain changes addresses between two measurement times.
• IPv4 works while IPv6 fails, or the reverse.
• Several unrelated domains share the same filtering response.
• DNS answers differ between Australian providers.

Details that should accompany a finding

• The exact hostname and observed IP address.
• The probe location, resolver, protocol, and timestamp.
• The response type, such as timeout, reset, block page, or DNS error.

Keeping The Domain List Current

Dynamic infrastructure means monitoring cannot rely on a permanent list of addresses. A domain that moves to a new host, adds IPv6, or joins a CDN may produce a different technical profile within hours. Retesting and timestamping are therefore central to maintaining useful records.

Users who notice a service missing from the monitored set can submit a site for review. A submitted domain can then be assessed by the same kinds of DNS, probe, and response checks used for other entries. Inclusion in monitoring is not a claim that the site is censored; it creates an opportunity to observe its accessibility across locations.

The central principle is simple: domains are the objects being tested, while IP addresses are changing infrastructure clues. By preserving both, Net Neutrality Monitor can identify possible shared-address effects without confusing hosting geography with website ownership. What readers should remember is that a changing IP can explain a difference in access, but only hostname-specific, time-stamped, repeated evidence can show what is actually being filtered.