{"id":1880,"date":"2025-10-17T18:10:48","date_gmt":"2025-10-17T18:10:48","guid":{"rendered":"https:\/\/shreyapohekar.com\/blogs\/?p=1880"},"modified":"2025-10-17T18:10:49","modified_gmt":"2025-10-17T18:10:49","slug":"bugbounty-how-to-find-the-owner-of-ip-address","status":"publish","type":"post","link":"https:\/\/shreyapohekar.com\/blogs\/bugbounty-how-to-find-the-owner-of-ip-address\/","title":{"rendered":"Bugbounty – How to find the owner of IP address"},"content":{"rendered":"\n

Hi everyone \u2014 I\u2019m Shreya. In this post, I\u2019ll explain how to identify the owner or owning organization of an IP address.<\/p>\n\n\n\n

When doing bug bounty work, we often use tools like FOFA and Shodan to discover IPs that might belong to the organization we\u2019re targeting. Many times, the program you are submitting to may respond that the IP isn\u2019t owned by them.<\/p>\n\n\n\n

While it\u2019s true that identifying the correct owner can be challenging about 10% of the time, in roughly 90% of cases you can accurately determine the rightful owner. Knowing this will help you decide whether or not to submit the bug you\u2019ve found.

Here\u2019s a compact, practical playbook you can use right away to find the organisation\/company that \u201cowns\u201d any IPv4\/IPv6 address.
Let’s get started.<\/p>\n\n\n\n

<\/p>\n\n\n\n

    \n
  1. WHOIS lookup<\/strong> \u2014 primary source for allocation and org info.
    Command (Linux\/macOS): whois 8.8.8.8<\/code> Look for fields like OrgName<\/code>, NetName<\/code>, NetRange<\/code>\/CIDR<\/code>, country<\/code>, and origin<\/code> or originAS<\/code> (sometimes different on ARIN vs RIPE).
    \"\"
    Windows: install Sysinternals whois<\/code> or use online WHOIS.<\/li>\n\n\n\n
  2. Check the originating AS \/ BGP info<\/strong> \u2014 tells you which Autonomous System routes the IP (often company \/ ISP).
    Use a web tool like https:\/\/bgp.he.net\/ip\/8.8.8.8<\/code> or: whois -h whois.radb.net -- '-i origin AS15169'<\/code> (Or visit bgpview.io, bgp.he.net, or bgp.tools and paste the IP.)
    <\/li>\n\n\n\n
  3. Reverse DNS (PTR)<\/strong> \u2014 gives a hostname that may reveal the provider\/company: dig -x 8.8.8.8 +short # or nslookup 8.8.8.8<\/code>
    <\/li>\n\n\n\n
  4. Traceroute<\/strong> \u2014 useful to see which networks an IP transits (may hint at ISP \/ company): traceroute 8.8.8.8 # Windows: tracert 8.8.8.8<\/code><\/li>\n\n\n\n
  5. Online IP lookup services<\/strong> \u2014 fast summary + useful metadata:\n
      \n
    • ipinfo.io (curl ipinfo.io\/8.8.8.8\/json<\/code>)<\/li>\n\n\n\n
    • ip-api.com (curl http:\/\/ip-api.com\/json\/8.8.8.8<\/code>)<\/li>\n\n\n\n
    • whois.domaintools.com, bgpview.io, viewdns.info, ARIN\/RIPE\/APNIC web WHOIS pages<\/li>\n<\/ul>\n<\/li>\n\n\n\n
    • Search SSL certificate \/ website info (if port 443 responds)<\/strong> \u2014 the cert owner can point to the organization: openssl s_client -connect 8.8.8.8:443 -servername example.com <\/dev\/null 2>\/dev\/null | openssl x509 -noout -subject,issuer<\/code> Or curl with -v<\/code> to inspect server headers.<\/li>\n\n\n\n
    • Use Internet-wide scanners \/ archives<\/strong> \u2014 Shodan, Censys, ZoomEye show services running on the IP and sometimes organisational tags (requires account):\n
        \n
      • shodan.io, censys.io<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
        \n\n\n\n

        Example: interpret WHOIS output (what to look for)<\/h1>\n\n\n\n

        WHOIS snippet might show:<\/p>\n\n\n\n

          \n
        • OrgName<\/code> \/ OrgId<\/code> \u2014 the registered organisation<\/li>\n\n\n\n
        • NetRange<\/code> or CIDR<\/code> \u2014 the IP block assigned<\/li>\n\n\n\n
        • NetName<\/code> \u2014 short name for block (e.g., GOOGLE, AKAMAI)<\/li>\n\n\n\n
        • country<\/code> \u2014 country of registration<\/li>\n\n\n\n
        • origin<\/code> \/ originAS<\/code> \u2014 BGP AS number (e.g., AS15169)<\/li>\n\n\n\n
        • abuse<\/code> or tech<\/code> contact \u2014 who to contact for abuse reports<\/li>\n<\/ul>\n\n\n\n

          If WHOIS shows a Regional Internet Registry (RIR) like ARIN\/RIPE\/APNIC, follow the RIR link to get the canonical org record.<\/p>\n\n\n\n

          \n\n\n\n

          Handy one-liners<\/h1>\n\n\n\n

          WHOIS:<\/p>\n\n\n\n

          whois 1.2.3.4 | egrep -i 'org|netname|origin|cidr|abuse|descr'\n<\/code><\/pre>\n\n\n\n
          IP info via curl:<\/p>\n\n\n\n
          curl -s ipinfo.io\/1.2.3.4\/json\n<\/code><\/pre>\n\n\n\n
          Get ASN and prefix (using ipinfo<\/code>):<\/p>\n\n\n\n
          curl -s ipinfo.io\/1.2.3.4\/org\n<\/code><\/pre>\n\n\n\n
          \n\n\n\n
          The IP I found belongs to Microsoft\/ Google\/ Amazon or similar Cloud provider<\/h1>\n\n\n\n
          You might have come across IP addresses where the WHOIS<\/strong> response shows information related to Microsoft<\/strong>, Google<\/strong>, or Amazon<\/strong>. Naturally, you get excited and rush to submit your findings \u2014 only to face disappointment when the report gets closed as \u201cNot our IP.\u201d<\/em><\/p>\n\n\n\n
          This usually happens because these companies are major cloud providers<\/strong> with massive pools of IP addresses that are allocated to their customers<\/strong>. The bugs you discover on such IPs typically belong to the customer\u2019s infrastructure<\/strong>, not the cloud provider\u2019s \u2014 and since the provider has no control over those assets, these reports are generally closed.<\/p>\n\n\n\n
          So, the real question is: How do you know whether you\u2019re hunting on a customer-owned IP or a program-owned IP?<\/strong><\/p>\n\n\n\n
          Finding this out can sometimes be tricky, and there will be cases where identifying the true owner of an IP just isn\u2019t possible. However, here are a few simple techniques I use to make an informed decision about whether to submit a report:<\/p>\n\n\n\n
            \n
          • Check the footer<\/strong> of the landing page. If it\u2019s a customer-owned IP, their company name often appears there.<\/li>\n\n\n\n
          • Look at the page title.<\/strong> Sometimes, the organization\u2019s name is visible in the title bar.<\/li>\n\n\n\n
          • If you find a bug on an IP like 12.13.45.65:8081<\/code> and there\u2019s no identifying information, try removing the port number<\/strong>. It may redirect you to the main domain \u2014 for example, example.com<\/code> \u2014 revealing the actual owner.<\/li>\n<\/ul>\n\n\n\n
            These quick and easy tricks can save you a lot of time when hunting on IPs.<\/p>\n\n\n\n
            If you have any other techniques for identifying IP ownership, share them in the comments below \u2014 I\u2019d love to learn about them!<\/p>\n\n\n\n
            That\u2019s all for this post. See you in the next one \u2014 until then, happy hunting!<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"
            Hi everyone \u2014 I\u2019m Shreya. In this post, I\u2019ll explain how to identify the owner or owning organization of an IP address. When doing bug bounty work, we often use tools like FOFA and Shodan to discover IPs that might belong to the organization we\u2019re targeting. Many times, the program you are submitting to may […]<\/p>\n","protected":false},"author":1,"featured_media":1884,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[294,2],"tags":[463,466,465,464],"class_list":["post-1880","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud","category-information-security","tag-ip","tag-ipinfo","tag-orgname","tag-whois","entry","has-media"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/posts\/1880"}],"collection":[{"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/comments?post=1880"}],"version-history":[{"count":2,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/posts\/1880\/revisions"}],"predecessor-version":[{"id":1883,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/posts\/1880\/revisions\/1883"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/media\/1884"}],"wp:attachment":[{"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/media?parent=1880"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/categories?post=1880"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/tags?post=1880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}