Whose server? What evidence?

Finding an IP may be easy. Linking it to the right company is a separate job.

Think of a shared building

One building can hold many shops. In the same way, one IP can serve many sites. A cloud IP may identify the provider, not the customer. One ASN or favicon is not proof of ownership. Check for a shared agency or copied code.

A scan record has a date

Shodan and Censys can show stored observations. Read the scan time and coverage. Port 443 often means HTTPS, 22 SSH, and 80 HTTP, but services can use other ports. An open port or old banner does not confirm a vulnerability.

One IP, different possibilities. Shared hosting. CDN. One operator. Old record — The map shows possibilities. Evidence helps decide which fits.CSINT Research · Ahmet Göker

Same terms in both languages

Keep these words

Attribution: Linking an action or system to an operator.
CDN / Origin server: A distributed content service / the source server behind it.
Banner: Information a service reports about itself.
Exposure / Vulnerability: A visible or reachable service / a weakness.
Scan time: When a scanner observed a service.

A small example

Let’s do it together

Liman’s site and another site appear on the same CDN IP.

Write the DNS source and observation time.
Check whether the IP belongs to a shared CDN service.
Look for company records and dated official links for ownership. No proven link does not prove they are unrelated.

Close the notes. Think first.

Your turn

An old scan shows a database port open. Do you fetch its data to check today?

Read the explanation

Not without permission and scope. The record is a clue. It does not permit bypassing controls or taking data.

Reading record

Only on this browser. These marks are not test results.

Sources

I used my study notes and wrote new practice examples. The source PDF is not distributed here.

About the sources and rights