Information Gatheringosintreconnaissancebingiphostnamessubdomainspenetration testing

bing-ip2hosts

bing-ip2hosts is a Bing.com web scraper that discovers hostnames and websites associated with an IP address. It leverages Bing's unique IP-based search feature to enumerate subdomains and identify shared hosting environments.

Description

bing-ip2hosts enumerates hostnames for an IP using bing.com, a search engine that uniquely allows searching by IP address. This tool is designed for OSINT and reconnaissance during penetration tests or bug bounties to expand the target's attack surface by discovering subdomains and related domains.

It helps identify websites hosted in shared hosting environments and follows best practices in the reconnaissance phase. Unlike many other recon tools that scrape Bing, bing-ip2hosts features smart scraping behavior to maximize hostname discovery.

The tool provides output options including plain hostnames, CSV format, and customizable scraping parameters for language, market, and result limits.

How It Works

bing-ip2hosts scrapes Bing.com search results using the IP address search feature. It intelligently paginates through results, tracking new hostnames found per page, and stops after a configurable number of pages (default 5) yield no new results. It handles setlang and setmkt parameters for language and market localization, using wget for web requests and temporary directories for caching.

Installation

bash
sudo apt install bing-ip2hosts

Flags

-o FILEOutput hostnames to FILE.
-i FILEInput list of IP addresses or hostnames from FILE.
-n NUMStop after NUM scraped pages return no new results (Default: 5).
-lSelect the language for use in the setlang parameter (Default: en-us).
-mSelect the market for use in the setmkt parameter (Default is unset).
-uOnly display hostnames. Default is to include URL prefixes.
-cCSV output. Outputs the IP and hostname on each line, separated by a comma.
-qQuiet. Disable output except for final results.
-t DIRUse this directory instead of /tmp.
-VDisplay the version number of bing-ip2hosts and exit.

Examples

Scrapes Bing for hostnames resolving to microsoft.com IP, showing progress like [ 65.55.58.201 | Scraping 1 | Found 0 | / ] and lists results including http://microsoft.com, http://research.microsoft.com.
bing-ip2hosts -p microsoft.com
Enumerates hostnames for IP 173.194.33.80, showing scraping progress [ 173.194.33.80 | Scraping 60-69 of 73 | Found 41 | | ] and results like http://asia.google.com, http://desktop.google.com.
bing-ip2hosts -p 173.194.33.80
Displays help and usage information including all available options.
bing-ip2hosts -h
Searches for hostnames associated with IP 192.168.1.1 and saves results to output.txt file.
bing-ip2hosts -o output.txt 192.168.1.1
Reads list of IPs or hostnames from ips.txt file and enumerates associated hostnames for each.
bing-ip2hosts -i ips.txt
Outputs hostnames for example.com IP in CSV format without URL prefixes.
bing-ip2hosts -c -u example.com
Quietly scrapes for hostnames of 8.8.8.8, stopping after 3 pages with no new results.
bing-ip2hosts -q -n 3 8.8.8.8
Updated 2026-04-16kali.org ↗