Pivot from ASN to the full external footprint

DNS-first recon misses hosts with no name. Begin from the org’s autonomous system to get the netblocks it announces, then sweep them.

amass intel -org "Target Inc" -asn
whois -h whois.radb.net -- '-i origin AS12345' | grep -Eo "([0-9.]+/[0-9]+)"

Scan the ranges for live services.

naabu -host-list ranges.txt -top-ports 1000 -silent | httpx -silent -title -tech-detect

Pro note: confirm ownership before scanning; cloud IPs in an ASN may belong to the provider, not the target, and are out of scope. Correlate discovered hosts back to the org via TLS certificate names and reverse DNS to avoid straying onto someone else’s assets.