DNS enumeration, subdomain discovery, async port scanning, web fingerprinting, WHOIS, GeoIP enrichment, and AI-generated target profiles.