# Scanning IP Blocks

Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses.

### Identify AS Number:

{% embed url="https://bgp.he.net/" %}

### Public IP blocks discovery

* [Shodan](https://www.shodan.io/)
* [Censys](https://search.censys.io/)
* [Hunter.how](https://hunter.how/)
* [onyphe.io](https://www.onyphe.io/)
* [en.fofa.info](https://en.fofa.info/)
* [app.netlas.io](https://app.netlas.io/)
* [fullhunt.io](https://fullhunt.io/)
* [binaryedge.io](https://www.binaryedge.io/)

### Sub domain discovery

* [amass](https://github.com/owasp-amass/amass)
* [crt.sh](https://crt.sh/)
* [Censys](https://search.censys.io/)
* [Facebook Developer](https://developers.facebook.com/tools/ct/)
* [sublist3r](https://github.com/aboul3la/Sublist3r)
* [subfinder](https://github.com/projectdiscovery/subfinder)
* [Theharvester](https://github.com/laramies/theHarvester)
* [assetfinder](https://github.com/tomnomnom/assetfinder)
* [virustotal](https://www.virustotal.com/gui/home/upload)
* [Phonebook](https://phonebook.cz/)
