Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.

Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Gather Victim Network Information
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1590  external_id: T1590     source_name: WHOIS  description: NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020.  url: https://www.whois.net/     source_name: DNS Dumpster  description: Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.  url: https://dnsdumpster.com/     source_name: Circl Passive DNS  description: CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.  url: https://www.circl.lu/services/passive-dns/     