5

Is there any way to find out company/domain name of the company name by a given AWS IP address owned by them? nslookup and centralops.com will show only indicate the IP is on AWS.

4
  • 2
    AWS hands out flex IPs and might even share an IP across multiple 'owners' Plus, with so many services, it might be impossible to determine who is using a particular IP at any one time.
    – schroeder
    Commented Sep 5, 2017 at 19:22
  • connect to port 80 (or 443 with SSL engaged) of that IP and make an HTTP request (with the hostname that might be known) and see what they say. if you are wanting to identify criminals operating an illegal site you will need to contact law enforcement who can then contact AWS (who won't give out such information to just anyone who asks for it).
    – Skaperen
    Commented Sep 6, 2017 at 1:00
  • also consider the means how the IP was obtained. it might be from a host/domain name lookup. where did that name come from? it might be linked from another page. if you are trying to collect a list of AWS customers, it will be hard. or try the technique i have used for phone numbers: google it
    – Skaperen
    Commented Sep 6, 2017 at 1:05
  • @Skaperen you are assuming that the IP is linked to a web server. AWS offers a stunning array of services beyond websites.
    – schroeder
    Commented Sep 6, 2017 at 10:31

2 Answers 2

2

With an IP alone it will be difficult.

What you can do is gauge the IP Range. If it's a company they might own a range of IP Address and not a single one, you can try to increment/decrement the IP you know and reverse lookup it. The goal is to fetch a domain name.

This approach is approximative, and you will never be 100% sure of the result.

Well, it's possible to push the IP investigation further, but that include the use of illegal techniques, so i will not recommend it nor state how to proceed.

On the other hand if the IP is attached to a domain name it can be done pretty easily with a bit of luck. In a legal way.

(Like @Schroeder stated, keep in mind that if it's a shared IP it will be nearly impossible.)

1
  • 1
    AWS IPs (the v4 ones) are not typically in ranges.
    – Skaperen
    Commented Sep 6, 2017 at 1:13
2

First, I suggest that you verify that the IPv4 /32 prefix is indeed owned by Amazon and used for their AWS/EC2 spaces. You can check a resource such as -- https://github.com/client9/ipcat/blob/master/datacenters.csv

Often you'll see fat-fingered DNS resource records or miscellaneous IP/TCP/HTTP redirects or even reverse proxies. Note this infrastructure.

You can search the IPv4 address on censys.io:

e.g., https://censys.io/ipv4/52.xx.xx.xx/table -- (or even the main search page)

You can also search the hostname, e.g., ec2-52-xx-xx-xx.us-west-1.compute.amazonaws.com

If the IPv4 address or host has run SSL/TLS services, then you can narrow in on the following fields: subject_alt_name.dns_names, parsed.names, subject.common_name, subject.organization, get.body, headers.link, headers.unknown, get.title, and possibly others. You can verify the information from censys.io on crt.sh, shodan.io, lanrat.github.io/certgraph/, dnsdumpster.com and zoomeye.org. ZoomEye typically will let you query for information from the past as well.

If the IPv4 address has never hosted anything, not even SSH or RDP (which also provide certificates that often contain the org's name) -- then you may be out of luck and reached a dead end.

If you believe the IPv4 address or host has been involved in malware communications or as a source of threat activity, try searching abuseipdb.com, threatminer.org, and cymon.io

1

Not the answer you're looking for? Browse other questions tagged .