cipher - There's been a kidnapping!

Alfred C. Bacon, an avid puzzler, has been kidnapped! Fortunately, we were able to find where he was being held. Unfortunately, he was no longer there. Fortunately, he left us a note, letting us know that he was safe, (although not necessarily happy). Fortunately, he let us know that he had encoded his kidnapper's name in a hidden message. Unfortunately, our intrepid police force has hit a brick wall with how to solve his puzzle. They believe that it's tied to his internet history.

They have sent you, the denizens of https://puzzling.stackexchange.com, the entirety of his browsing history, and are relying on you to figure out who the kidnapper is so that they can once again begin the search for Freddy.

twitch.tv                       10/11/17 11:17 PM   50.112.196.159
microsoft.com                   10/10/17 6:30  PM   191.239.213.197
amazon.com                      10/10/17 10:45 AM   54.239.25.192

gizmodo.com                     10/9/17  9:42  AM   151.101.193.34
kickstarter.com                 10/9/17  5:41  AM   13.33.76.156
discord.gg                      10/8/17  6:19  PM   104.16.60.37
lastpass.com                    10/8/17  6:12  PM   88.221.62.48
instagram.com                   10/7/17  9:45  PM   34.195.2.28
open.spotify.com                10/7/17  12:30 PM   104.199.64.136
southwest.com                   10/6/17  9:45  PM   208.94.153.100
imgur.com                       10/6/17  8:16  AM   151.101.36.193
kotaku.com                      10/6/17  8:12  AM   151.101.129.34
monster.com                     10/6/17  8:07  AM   63.121.30.147

ebay.com                        10/6/17  8:03  AM   66.211.162.12
xkcd.com                        10/5/17  4:30  PM   151.101.0.67
msn.com                         10/4/17  11:11 AM   13.82.28.61
walmart.com                     10/4/17  9:17  AM   161.170.248.20
puzzling.stackexchange.com      10/4/17  7:30  AM   151.101.193.69
reddit.com                      10/2/17  8:31  PM   151.101.193.140
bankofamerica.com               10/2/17  4:15  PM   171.159.228.150
wikipedia.org                   10/2/17  12:35 PM   91.198.174.192
buzzfeed.com                    10/2/17  4:26  AM   13.33.76.217
gmail.com                       10/1/17  9:35  PM   216.58.209.110

aol.com                         10/1/17  6:49  PM   207.200.74.55

Who kidnapped Mr. Bacon?

HINT:

The police have approached you with a piece of new information! They found a piece of paper stuck to the bottom of the otherwise empty trash bin that looks like this:

HINT 2:

It looks like the police were able to successfully recover part of a file from the otherwise empty hard drive! Here's the portion of the file that they recovered:

_ic__t_rter.co_ _CC

You'll notice

_ot__u.co_

some of the sites

_icro_oft.co_ BFEF_C

have letters missing.

___.co_ C

That's because the police

pu__li_g._tac_exch__ge.co_ C

Are police, not the FBI. However, they're very sure that what they have is right, and are also sure that it's got SOMETHING to do with the code. They just don't have any idea what.

As an aside, is it possible to have a block quote with a spoiler? That would have made the answer much easier to type.

Hint 3:

IP Addresses have been added to the original list. They were divined by the police's voodoo magic, and definitely not from phroureo's spreadsheet where he saved them all. I sure hope there's not typos in the list again, because that would be embarrassing.

---

Fair warning: this puzzle is VERY enigmatic. Hints will come periodically as necessary, but eventually, it should be solvable. I hope. :P To be honest, I thought about adding even more layers, but in the end decided to save them for the next puzzle.

Answer

The name of our victim (and the first hint => AABBB) suggests that this puzzle has something to do with the Bacon's cipher. The hard thing is to find groups of five letters which were used to encode the message.

The third hint adds IP addresses of the visited websites, which suggests that they were used to encode the message. The second hint (_icro_oft.co_ BFEF_C) tells us, we should transform the IP addresses from the decimal to hex representation:

3270C49F
BFEFD5C5
36EF19C0

9765C122
0D214C9C
68103C25
58DD3E30
22C3021C
68C74088
D05E9964
976524C1
97658122
3F791E93

42D3A20C
97650043
0D521C3D
A1AAF814
9765C145
9765C18C
AB9FE496
5BC6AEC0
0D214CD9
D83AD16E

CFC84A37

The second hint also implies, that we should ignore all digits in the hex representation which gives the following list:

CF
BFEFDC
EFC
C
DCC
C
DDE
CC
C
DE

C

FE
DAC

DCD
AAAF
C
CC
ABFE
BCAEC
DCD
DADE
CFCA

Let's join these letters in chronological order (bottom to top):

CFCADADEDCDBCAECABFECCCAAAFDCD DACFE CDECCCDDECDCCCEFCBFEFDCCF

The groups of letters are all divisible by 5, which means we are really close now. Using some trial and error we can map the six different letters to A and B usually used in the notation of Bacon's cipher (ABC => A, DEF => B):

ABAABABBBABAAABAAABBAAAAAABBAB BAABB ABBAAABBBABAAABBAABBBBAAB

Using the 26 letter variant of the cipher we can find out the name of the kidnapper:

JORDAN T MORTZ