Maybe in certain countries. But not outright illegal everywhere. Check out the 2022 amendment to the CFAA. Good-faith security research is protected. Simply scanning external networks falls under good-faith security research as there is no exploitation involved. And even if there was, you could still claim good-faith if you alert the owner of the network and not use the exploit for malicious purposes.
Yes you can , first you have to recognize the net work you want to attack, first you have look for the IP because Nmap works whit ip addresses , ping the DNS FROM THE NETWORK and it will return a IP address , this doesn’t mean that tha it’s the original IP address from the place it could work whit a third party company first you have to see if it’s a up server then type this
Nmap -sT -sS ( IP address )
Then use that info to look if it’s a aaa place
And if you have doubt
Type
Nmap -h
Always remember that back ends and front ends always leave port 80 and port 444 open