View Source IPs That Queried a Zone in UltraDNS

This article explains how to use the Advanced Client IP report in UltraDNS to view source IP information for DNS queries sent to a zone. 

This report can help identify which client networks or client IP addresses queried a zone or hostname during a selected date range.

When to Use This Article

• You need to see which source IPs queried a zone.
• You need to review query response volume by client network.
• You need to view hostnames queried within a zone.
• You need to export Advanced Client IP report results to a CSV file.

Before You Begin

• The Advanced Client IP report is an advanced report.
• If your account does not have Advanced Reporting enabled, the report may not be available or may show different reporting details.
• The current date, based on GMT, cannot be selected for this report.
• The date range cannot exceed 31 days.
• The date range cannot be more than 90 days before the current date.
• You can select up to 250 zones when filtering by zone name.

What the Advanced Client IP Report Shows

The Advanced Client IP report displays response counts for client networks that queried your zones.

Depending on the data available for your account and report view, the report can include details such as:

• Client Class C: The Class C network where the DNS queries originated.
• Zone Name: The zone that was queried.
• Host Name: The hostname that was queried.
• Responses: The number of responses returned for the query.
• Client IP: The client IP address identified for the query.
• Country, Region, City, and Postal Code: Location details associated with the query source when available.

View Source IPs for a Zone

1. Log in to UltraDNS.
2. Click Reports.
3. Click Advanced Client IP.
4. Select the Date Range for the report.
5. Select the Zone Name or zone names you want to review.
6. Click Apply.

The report updates using the selected date range and zone filter.

View Hostnames Queried Within a Zone

The report can be expanded to show more detailed query information, including the hostname queried within the selected zone.

1. After the report results load, select or expand the Client Class C data.
2. Review the expanded Client IP information, when available.
3. Select or expand the Host Name data to view hostname-level query details.

Use the available columns to review the relationship between the client network, client IP, queried zone, queried hostname, and response count.

Sort the Report by Responses

1. Find the Responses column.
2. Use the column sort option to sort the report by response count.

Sorting by Responses can help identify the client networks or client IPs with the highest query volume in the selected report results.

Export Report Results

1. After the report results load, click Export.
2. Select the CSV export option.
3. Download the exported file when it is available.

The exported CSV contains the report details currently included in the report results, up to the supported export limit.

Investigating Client IP Ownership

UltraDNS displays client IP and client network information when that data is available in the report. 

To investigate who owns a public IP address, use a public IP WHOIS or RDAP lookup tool outside the UltraDNS portal.

WHOIS or RDAP results may show the network owner, provider, or abuse contact associated with the IP address. 

The information returned depends on the public registration data for that IP address.

Expected Outcome

After completing these steps, you should be able to view source IP or client network query data for the selected zone and date range. 

You can also expand available report details to review queried hostnames and export the results for offline analysis.

Important Notes

• The report data depends on the selected date range, zone filter, account access, and Advanced Reporting availability.
• If a zone you enter is not available to your user, the report may return no results for that zone.
• If you have access to multiple accounts, only accounts with Advanced Reporting enabled are shown for this report.
• If the report does not show the expected columns, use Select Columns to configure the visible report columns.