Brute force IP crawling (this is how Shodan.io works). SSL Cert transparency logs. Remember that bot nets and other malware allow the type of scale that you w

Brute force IP crawling (this is how Shodan.io works). SSL Cert transparency logs. Remember that bot nets and other malware allow the type of scale that you wouldn't expect. There is a big advantage for the first mover in hacking. I wouldn't be surprised if nation states or cyber mafias paid bounties to lots of contractors for identified vulnerable boxes to use as intermediate proxies (although there are so many I'm not sure if bounties would pay well).