The Premise: You Already Live in a Glass House
There is a comfortable lie that organizations tell themselves: that their infrastructure is private until someone "hacks in." It is not. The moment a device answers a packet, it has published its existence. Internet-wide scanning made the entire address space legible years ago. The question is never whether you are mapped — it is whether you have read your own map before an adversary reads it for you.
I am going to teach you to read it. This is OSINT tradecraft, performed only against assets you own or are authorized to assess. Nothing here is exotic; all of it is public. That is precisely the point.
The Four-Layer Model
Mature analysts do not look at "an IP." They look at four superimposed layers, and they correlate across them:
- Geographic layer — where the physical machine sits. Datacenter, city, jurisdiction. This governs latency, legal exposure, and which cables your traffic rides.
- Physical network layer — the cables, satellites, and transit that carry the bits. Submarine cable landings and peering facilities are chokepoints.
- Logical network layer — routers, autonomous systems, prefixes. This is where BGP and ASN analysis lives.
- Cyber-persona layer — the human and organizational identity behind the asset. Domains, certificates, registrant data, developer fingerprints.
A finding only becomes intelligence when it survives correlation across all four. A single open port is noise. An open management port, on a prefix announced by your ASN, with a TLS certificate naming your company, geolocated to your colo — that is a story.
Discovery Without Touching the Target
The discipline is to learn everything from data that already exists. You do not scan a target you are assessing until the passive picture is exhausted.
Passive, certificate-driven enumeration:
# Subdomains and infrastructure from certificate transparency logs
curl -s "https://crt.sh/?q=%25.yourcompany.com&output=json" \
| jq -r '.[].common_name' | sort -u
Search-engine reconnaissance of your own surface (Shodan / Censys):
# Shodan: everything attributed to your org that answers the internet
org:"Your Company"
ssl.cert.subject.CN:"yourcompany.com"
http.title:"Login"
# Censys equivalent for service + certificate pivoting
services.tls.certificates.leaf_data.subject.organization: "Your Company"
Logical-layer mapping (which prefixes are actually yours):
# Find the ASN, then enumerate the announced prefixes
whois -h whois.radb.net -- '-i origin AS_YOUR_NUMBER' | grep route
When you put those together you stop seeing a list of hosts and start seeing the shape of your organization on the internet — the same shape an adversary builds during target development.
The Array Is a Pattern, Not a List
Here is the mindset shift that separates a scanner-jockey from an analyst. A list of IPs is storage. A correlated set of prefixes mapped to autonomous systems is pattern-of-life. When you arrange your discovered assets by ASN, by certificate issuer, by first-seen date, the anomalies announce themselves: the shadow-IT subdomain on a consumer ASN, the forgotten staging box with a wildcard cert, the acquisition whose infrastructure was never folded into your monitoring. Those gaps are where incidents are born.
Turning the Map Into Defense
Reading the map is reconnaissance. Acting on it is engineering:
- Reduce the surface. Every service that answers without a business reason is debt. Close it or put it behind authenticated access.
- Watch certificate transparency for yourself. New certs naming your domains that you didn't issue are an early breach indicator. Subscribe to CT log monitoring.
- Baseline your ASN announcements. A prefix you don't recognize being announced near your space can signal BGP hijack or misconfiguration.
- Continuously re-map. The surface is not static — cloud spins assets up hourly. A point-in-time audit is a photograph of a river.
The Ethics Are Not Optional
Internet cartography is lawful when it is passive or authorized. Reading public CT logs, querying Shodan, parsing BGP — all fine. Active scanning of infrastructure you neither own nor have written authorization to test is a different country with different laws. The professionals understand the line precisely because they operate at its edge. Map your own glass house. Get written scope before you map anyone else's.