External Attack Surface Discovery

For an authorized organization domain, enumerate candidate public hostnames, resolve selected names to current IP addresses within the approved scope, scan those IPs for open TCP ports, then fingerprint discovered services. Compare results with an authoritative asset inventory to identify potentially unmanaged exposure; enumeration and scanning alone do not establish asset ownership or shadow-IT status.