Inital Scans

nmap -p- --min-rate=1000 -Pn -v $ip 

nmap -sC -sV -T5 -Pn -p $open_ports $ip

nmap -sU -T4 -F -v $ip
nmap -p $open_ports --script=vuln -T5 -Pn $ip

nmap -p $open_ports -sC -sV --script=vuln -T5 -Pn $ip

echo $ip domain | sudo tee -a /etc/hosts

Name of the box may be a service or username. Spam both lol