TL;DR: Find org-owned IP ranges via BGP / WHOIS; turn them into ports, services, vhosts. Routed-block IPs are often under-monitored.
Stub — to be filled in.
What it is
TODO
Preconditions / where it applies
TODO
Technique
TODO
Detection and defence
TODO
References