[tgtweak]

Am I right to see that if a domain doesn't have records in censys or shodan that this tool will need some aggressive scanning?

[blackflame7000]

In the general case you are looking for server farms (digital ocean/amazon/etc) and passing the host header to get around reverse proxies. That could still be several million ipv4 numbers