You get a "Transfer Failed" or "Refused" message (most modern servers are patched). 4. Automated Tools for Speed
Reverse DNS on IPs to find more domains dig -x 192.0.2.5 simple dns plus enumeration
This information is the blueprint for an attack. Once an attacker knows the IP of a development server ( dev.target.com ) that hasn't been patched, the attack surface shrinks dramatically. You get a "Transfer Failed" or "Refused" message