As you stated, the
-Pn flag assumes the host is already 'up' and sends no packets to confirm, while the
-sn flag disables port scans entirely.
In summary, what you are doing with a scan like this is attempting a reverse DNS resolution of the host, which attempts to enumerate the name of the host (in this case taking the IP and searching to see if it resolves to a domain name), as it already assumes the host is 'up' and is further instructed to not perform any port scanning.
The reverse DNS resolution is generally attempted to be determined with the help of your
resolv.conf file (Unix) or the
Further information about this type of scan can be gleaned by either running Wireshark or
tcpdump and monitoring the traffic generated from the scan, as well as by passing the
--reason flags. Both of these flags will provide additional verbosity and aim to provide more clarity about the output.
The below links are great resources for understanding the anatomy of an Nmap scan.