Map 1
Strategies to find addresses and networks (IPv4/IPv6)
  Certificate Transparency
    Extract subjectAltName
      Resolving AAAA
        Adding most common hostname (short dictionary list)
        DNS brute-forcing
          SDBF
          fierce
          dnsenum
  Newly registered domains
  Passive DNS feed
    Extract CNAME, RRNAME
    Extract AAAA
  BGP Monitoring
  Discovering active IPv6 subnet from an IPv6 address
    Finding CIDR from RIR whois
    Active monitoring of public services logs (HTTP servers, public NTP servers)
  Blackhole network monitoring
    Extracting IPv6 addresses from GRE packets
    All protocols extraction "tshark -n -r $FILENAME -E separator="/n" -E occurrence=a -T fields -e ipv6.src ipv6.dst | sort -u | gzip -f
"
  Bitorrent GET_PEERS N6 request
  Guessing IPv6 addresses by using most common IPv6 manual allocations from an IPv6 subnet
    Enumerating easy to remember hex block (CAFE, DEAD, BEEF, ABBA, FFFF, ....)
    Enumerating TCP/UDP service port as last part
  DomainClassifier extraction (brute-force extraction of potential hostnames)
    GitHub commit streams
    Active crawling from CT logs
    Other sources such as social networks, pasties website, ....
  Extract potential hostname from IPv4 reverse PTR
    Enumerating IPv4/PTR
    Finding country TLD location (outside RIR allocation)