I wanted to know how can I get info on what sites are owned by certain company.I need it for bug bounty programs. For example how can I find what sites are owned by paypal company, like what sites have paypal in it's web address etc... Thanks
I find BGP Toolkit from Hurricane Electrics Internet Services quite useful for providing insight into any
For example, searching by term
which gives you a single
What is HE?
HE is one of the largest Internet backbone providers and can thus collate loads of infrastructure related information like the ones mentioned. You can search their database by
This is from their About page:
Also interesting (and relevant) to read is the page about their network. It gives a bit of insight into how they can collect all the data available through their search.
Of course, I'm not saying that HE is the only place to go. There are lots of other tools available, some paid and some more or less free to use and query. HE's one is however one I most frequently rely upon and I thought you might find it useful as well.
What do I use this information for:
I mostly use this information to compile
To answer your example directly, collating information from HE gives us this list of
(limited to include only
Some pages duplicate information from others as they're providing information on a sub-range of a larger range (smaller mask), like for example an IP range 220.127.116.11/22 would already be included in a 18.104.22.168/20 IP range.
What sites have 'paypal' in it's web address?
I'm going to make an attempt on answering this part of your question, however (as you probably can imagine) my answer can't be as straight-forward, because there isn't a single list of all registered domain names available to public, at least not that I'm aware of. Here's what I'd do:
The www.who.is website provides a bit difficult to navigate or search through domains index. Where do they collate all this information from is beyond my knowledge, I can only suspect they query individual registrars' databases on a regular basis.
Anyway, if you navigate their pages a bit you'll soon discover that the lists are organized in alphabetical order and then by page numbers (static URLs to individual pages). I guess you (or a CP savvy friend) could write a small utility crawler that would parse all this information into a single table and then do your search on it. If that's agreeable to the website operators and within their
If you did this, you would soon discover tens of thousands (educated guess) of registered domain names that include 'paypal' keyword in it. Most, I gather, are actually parked domains, expired domains, and the most awful of the bunch - phishing locations trying to lure unsuspecting Internet users to their addresses by mimicking official PayPal domain names. For example, take a look at this page and search for 'paypal' in it. 1883 matches in a single page, and only God knows how many pages are actually relevant to our search without resorting to crawling and collating data of each individual index page. They can't possibly be all registered by PayPal, Inc.!
I hope that at least partially answers also your 'other' question.
I'm a big fan of Robtex. Share and enjoy.
Robtex is a service that does forward and backward DNS and IP searches. You can search on a domain name, for example, and it will show give you information about: IP, IP Block, IP ownership, hosting servers, load balancing information, route mapping graphs, trace route latency information, AS numers and macros, DNS whois, DNS ownership, DNS reverse ownership, etc. You can also get information about if and where the domains are published on black lists IP records analysis, and more.
|show 1 more comment|