[sopranos31]

Hi,

I am currently learning OSINT and I am curious about this simple project. What  would be the best way to get all of the public IPs in a small to medium level company.

I would prefer passive reconnaissance, I am not aiming to disturb the company. I have used shodan, cenys and whois websites it doesn't seem enough.

[Beast99]

Hi bro , try these tools to me they work well : https://securitytrails.com/ , https://www.nslookup.io/ and https://dnsdumpster.com/ to see the IPs of DNS services and subdomains.