I and many other bug bounty researchers have tools that allocate AWS elastic IPs on a loop, looking for domains that point to them. (You don't get to pick what

I and many other bug bounty researchers have tools that allocate AWS elastic IPs on a loop, looking for domains that point to them. (You don't get to pick what IP you get, so you just have to pray for a good one!) It is a very profitable way to find vulnerabilities, but AWS detects and bans researchers for this activity. It's very, very easy to find random domains pointing to AWS IPs, although harder to find ones where the company has a bug bounty program. :)