Pivot map
Pivot from here
Outputs from Port Scan can become inputs for the next tool. These are the most relevant follow-on pivots in the library.
A global, open, stable, and secure Internet that serves the entire Asia Pacific community
ARIN is a nonprofit, member-based organization that administers IP addresses & ASNs in support of the operation and growth of the Internet.
AbuseIPDB provides IP reputation data and community abuse reports for identifying malicious hosts in network and threat investigations.
AccountKiller provides direct deletion links and step-by-step instructions for removing accounts on hundreds of websites and social platforms.
Investigator Use
Masscan is an open-source high-performance TCP port scanner capable of scanning the entire internet IPv4 address space in under six minutes at 10 million packets per second. Developed by Robert D. Graham, it is significantly faster than Nmap for large-scale port discovery while providing similar functionality for identifying open ports and basic service banners.
For authorized OSINT investigators and penetration testers, Masscan is the primary tool for large-scale port scanning when assessing the network exposure of an organization's IP space. When the target ASN or netblock has been identified through OSINT, Masscan can rapidly enumerate all open ports across the entire address range, creating a comprehensive map of externally exposed services.
Masscan's speed makes it practical for scenarios where Nmap would be too slow — scanning a /16 network (65,536 hosts) for all ports, scanning large cloud provider address ranges for specific service signatures, or performing internet-wide studies of specific port populations as part of threat research.
The tool outputs results in multiple formats including XML, JSON, and binary, enabling integration with subsequent analysis tools. Port scan results feed directly into service fingerprinting workflows (Nmap version scanning on discovered open ports), vulnerability assessment, and attack surface documentation.
For reconnaissance workflows, Masscan is typically used to rapidly identify which hosts in a large IP range have any open ports, followed by targeted Nmap version detection scans against only the live hosts. This two-phase approach combines Masscan's speed with Nmap's detailed fingerprinting capability.
Critical legal context: Port scanning without authorization is illegal in many jurisdictions and violates the terms of service of virtually all cloud providers and hosting services. Masscan's speed means it generates significant traffic that will be logged, detected, and potentially reported. Only use Masscan against IP ranges you own or have explicit written authorization to scan. For OSINT research using pre-existing scan data, Shodan and Censys provide legal access to internet-wide port scan data.
Document all scan parameters, target ranges, and authorization documentation before running. Retain all logs.
Before You Pivot
Capture the target, search terms, and why this source is relevant before you leave the page.
Archive volatile pages, save screenshots, and keep timestamps for anything that may change.
Treat one tool as a lead source. Confirm important findings with independent sources.
Related tools
CVE provides standardized vulnerability identifiers and references used in security research, triage, and threat intelligence workflows.
CVE Details aggregates vulnerability records, CVSS scores, and affected software lists for security analysis and patch prioritization.
Find default passwords and credentials for routers, printers, servers, and network devices for authorized security auditing.
The Exploit Database archives public exploits and proof-of-concept code for known vulnerabilities, used in penetration testing and research.
HoneyDB aggregates honeypot sensor data to identify malicious IP addresses, attacker tactics, and emerging threat patterns.
Hybrid Analysis provides free malware sandboxing with Falcon Sandbox technology to analyze suspicious files and URLs for threat intelligence.