Discover the domains and ranges an organization owns

amass-intel is the intelligence-gathering side of OWASP Amass. Instead of expanding one domain into subdomains, it works outward from an organization: search by company name, ASN, CIDR, or IP range and it returns the root domains and network blocks that belong to that target. That is the step before subdomain enumeration, where you figure out what an organization owns.

It pulls from the same broad set of data sources amass uses and adds reverse-whois lookups, so providing a few domains can surface other domains registered to the same entity. ASN and CIDR inputs let you pivot from a known network block to the names hosted on it, which is how you turn an IP range into a list of domains worth enumerating.

Run it first to establish scope, then feed the root domains it finds into amass or subfinder to enumerate subdomains across everything the organization owns. Pair -whois with seed domains when you want related registrations in the same pass.