Probing

# https://github.com/projectdiscovery/httpx
# go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
cat urls | httpx -random-agent -retries 2 -o out

cat subs.txt | httpx -silent \
  -sc -cl -title -tech-detect -server -location -ip -cname \
  -favicon -jarm -asn \
  -td -json -o probe.json

-sc            status code
-cl            content length
-title         page title
-tech-detect   Wappalyzer fingerprint
-favicon       mmh3 hash, pivot on it in Shodan/FOFA
-jarm          TLS fingerprint, groups hosts behind the same stack
-cname         spot the dangling records
-asn           tells you what is actually the target's

cat subs.txt | httpx -silent \
  -ports 80,443,8080,8443,8000,8888,3000,5000,9000,9090,7001,4443,10250

# everything that is not a boring 404
jq -r 'select(.status_code!=404) | "\(.status_code) \(.content_length) \(.url) \(.title)"' probe.json | sort -k1

# group by title: near-identical titles are one app, pick one and move on
jq -r .title probe.json | sort | uniq -c | sort -rn | head -40

# group by favicon hash: same hash, same product
jq -r '"\(.favicon) \(.url)"' probe.json | sort | uniq -c | sort -rn | head -20

cat subs.txt | httpx -silent -fl 0 -flc 1234

cat subs.txt | httpx -silent -location -sc          # see where it goes
cat subs.txt | httpx -silent -fr -sc -title         # then follow

401 / 403     something is there, see 403 Bypass
500           it ran your input
200 + 0 bytes worth a manual look
non-standard Server header