He also left out a bunch of other networks that one wouldn't really need to scan: 100.64.0.0/10 [0] and 198.18.0.0/15 [1] (and a bunch of /24s [2,3,4] too but, relatively speaking, those are pretty insignificant), although one might find some "interesting" (CGN) stuff in 100.64.0.0/10 if their ISP was making use of it.

There are also large portions of the 13 /8s (218 million IPs!) assigned to the US Department of Defense [5] that you wouldn't need to scan since there are no routes to them at all: the 11.0.0.0/8, 22.0.0.0/8, 26.0.0.0/8, 28.0.0.0/8, 29.0.0.0/8, 30.0.0.0/8, and 33.0.0.0/8 networks are, for all intents and purposes, "missing" from the public Internet.

Additionally, there are only four /24s in 21.0.0.0/8 that are reachable from the public Internet. Out of the 16,777,216 IP addresses that make up 7.0.0.0/8, only 255 are reachable (7.7.7.0/24) [6].

There's pretty much no point in scanning -- "mapping" -- this address place (unless you are looking specifically for US government/military stuff).

ETA: In the interest of time, you probably wanna skip over 44.0.0.0/8 [7] also.

[0]: https://tools.ietf.org/html/rfc6598

[1]: https://tools.ietf.org/html/rfc2544

[2]: https://tools.ietf.org/html/rfc5737

[3]: https://tools.ietf.org/html/rfc3068

[4]: https://tools.ietf.org/html/rfc7534

[5]: https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...

[6] Interestingly, the ASN (27651) that is advertising 7.7.7.0/24 into BGP appears to be registered to a company in Chile -- and they're also advertising 4.4.4.0/24. I would not be surprised to find out that neither of these advertisements are legitimate.

[7]: https://en.wikipedia.org/wiki/AMPRNet