So I just ran a test, with a secret domain name I haven't told anyone: $ (for x in `seq 1 500`; do echo -n "$x "; host -v MYSECRETDOMAIN. 8.8.8.8 2>&1 |gr

So I just ran a test, with a secret domain name I haven't told anyone: $ (for x in `seq 1 500`; do echo -n "$x "; host -v MYSECRETDOMAIN. 8.8.8.8 2>&1 |grep SOA; done) > data $ awk '($3 == 899) { print }' data | wc -l 34 That suggests there are about 34 machines near London. Neat! I repeated the test with: $ (for x in `seq 1 500`; do echo -n "$x "; host -v MYSECRETDOMAIN. 8.8.4.4 2>&1 |grep SOA; done) > data2 $ awk '($3 == 899) { print }' data2 | wc -l 3 which suggests the IP addresses share infrastructure (at least near London!) You can try this sort of thing with other providers to try and map out their internal infrastructure. (1.1.1.1/cloudflare has around 22 machines near me; quad9 has 16; opendns also has 16; verisign has 31; etc). One thing I tried was making an ad that recorded the cookie id in the impression tracker so I could record the connecting IP addresses in our DNS server. I could then target users who have a particular network provider (or use a particular DNS provider) which could be useful if I want a large number of users who (effectively) ignore DNS caches.