Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wanted to know how can I get info on what sites are owned by a certain company. I need it for bug bounty programs.

For example, how can I find what sites are owned by PayPal, like what sites have PayPal in it's web address etc...

share|improve this question
for example is that what you want? – Akam Jan 29 '13 at 20:10
up vote 13 down vote accepted

I find BGP Toolkit from Hurricane Electrics Internet Services quite useful for providing insight into any CIDR range, registrants, Who-Is info, IP and DNS info, IRR, assigned IPv4 and IPv6 CIDR ranges for individual ASNs, you name it. All data presented is also nicely linked to each-other for our convenience.

For example, searching by term PayPal will result in this table:

AS17012            PayPal, Inc.      PayPal, Inc.      PayPal, Inc.      PayPal, Inc.      PayPal, Inc.   PayPal, Inc.      PayPal, Inc.      PayPal, Inc.      PayPal, Inc.      PayPal, Inc.      PayPal, Inc.

which gives you a single ASN and a few assigned CIDR ranges that are registered to PayPal, Inc. These items in the list link to their individual info pages. Following the AS17012, for example, displays all kinds of information pertaining to this ASN, among others the list of Prefixes (in our case IPv4 CIDR ranges).

What is HE?

HE is one of the largest Internet backbone providers and can thus collate loads of infrastructure related information like the ones mentioned. You can search their database by registrant names, CIDR ranges, ASNs, IP addresses, and so on, all through the same input box and it will display either a list of possible matches, ordered by relevance and network range, or display a single match details when only one record is found. They also include a lot of various network related reports and statistics.

This is from their About page:

Hurricane Electric operates its own global IPv4 and IPv6 network and is considered the largest IPv6 backbone in the world as measured by number of networks connected... (and so on)

Also interesting (and relevant) to read is the page about their network. It gives a bit of insight into how they can collect all the data available through their search.

Of course, I'm not saying that HE is the only place to go. There are lots of other tools available, some paid and some more or less free to use and query. HE's one is however one I most frequently rely upon and I thought you might find it useful as well.

What do I use this information for:

I mostly use this information to compile blacklists and other network filters for my services. I find it especially useful to track down hosting companies and their CIDR ranges to include in content-theft, malware, spyware, and related policy blocks (in essence bad neighborhoods) when blocking by reverse DNS look-ups (and/or matching rDNS results with forward DNS look-up tables) wouldn't cut it.

Usage example:

To answer your example directly, collating information from HE gives us this list of A record domains operated by PayPal, Inc:,,

(limited to include only A records otherwise the list would stretch several pages long. This page alone, from one of several CIDR records, lists hundreds of domains.)

All relevant DNS records for our example can be found on pages,,,,, and

Some pages duplicate information from others as they're providing information on a sub-range of a larger range (smaller mask), like for example an IP range would already be included in a IP range.

What sites have 'paypal' in it's web address?

I'm going to make an attempt on answering this part of your question, however (as you probably can imagine) my answer can't be as straight-forward, because there isn't a single list of all registered domain names available to public, at least not that I'm aware of. Here's what I'd do:

The website provides a bit difficult to navigate or search through domains index. Where do they collate all this information from is beyond my knowledge, I can only suspect they query individual registrars' databases on a regular basis.

Anyway, if you navigate their pages a bit you'll soon discover that the lists are organized in alphabetical order and then by page numbers (static URLs to individual pages). I guess you (or a CP savvy friend) could write a small utility crawler that would parse all this information into a single table and then do your search on it. If that's agreeable to the website operators and within their TOS isn't something I've researched. Honestly, probably not and your crawler could be banned sooner than it would be able to crawl all relevant pages. You would still end up having larger data set than any publicly available ones (that I know of) and that can be easily searched through by a common expression.

If you did this, you would soon discover tens of thousands (educated guess) of registered domain names that include 'paypal' keyword in it. Most, I gather, are actually parked domains, expired domains, and the most awful of the bunch - phishing locations trying to lure unsuspecting Internet users to their addresses by mimicking official PayPal domain names. For example, take a look at this page and search for 'paypal' in it. 1883 matches in a single page, and only God knows how many pages are actually relevant to our search without resorting to crawling and collating data of each individual index page. They can't possibly be all registered by PayPal, Inc.!

I hope that at least partially answers also your 'other' question.


share|improve this answer

I'm a big fan of Robtex. Share and enjoy.

Robtex is a service that does forward and backward DNS and IP searches. You can search on a domain name, for example, and it will show give you information about: IP, IP Block, IP ownership, hosting servers, load balancing information, route mapping graphs, trace route latency information, AS numers and macros, DNS whois, DNS ownership, DNS reverse ownership, etc. You can also get information about if and where the domains are published on black lists IP records analysis, and more.

share|improve this answer
this answer would be a lot better if you explained what Robtex does... – Rory Alsop Jan 29 '13 at 20:12
This could definitely use a lot more meat. Perhaps describe what information they can provide. Maybe add in a bit about how they do it (Do they keep their own database, search through some public records, use some network discovery tools, etc.?). Alternatives (other sites offering similar services) would be good too. – Iszi Jan 29 '13 at 20:13
What makes Sec.SE distinct from a service like Google is (in part) that you know what to expect before actually clicking on the link. That's in that sense that link-only answers are deemed "low quality" and generally frowned upon. – Thomas Pornin Jan 29 '13 at 20:30
Re-reading the question, and reviewing the Robotex site, I'm not quite sure this is what the asker is looking for. See my other comment. – Iszi Jan 29 '13 at 20:48
grauwulf - as per the faq a link is not an appropriate answer on SE sites for a few reasons, including trying to avoid link rot, and trying to provide something over and above what google can do. So generally, a link only answer will be deleted if it isn't improved. – Rory Alsop Jan 29 '13 at 21:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.