Let’s say that you have a target and want to find the IP space for that target. By knowing this info you will have a good reference for how much they have out there on the internet.
The following sites will give you a good start to find infrastructures and hosts that owned by your target.
https://whois.arin.net/ui/query.do
https://apps.db.ripe.net/db-web-ui/fulltextsearch
Also, you can try reverse lookup to discover other sites hosted on the server and get all A records linked with your target. This can be used to discover more environments owned by your target.
https://hackertarget.com/reverse-ip-lookup/
https://viewdns.info/reverseip/
You can also use Shodan, the popular search engine for connected devices.
By using the above methods you can discover more top-level domains, IP addresses, subdomains, and more useful data that will help you in the recon process.
