When examining the addresses, one common feature stands out over 30% of the addresses on the same "C" network are on the lists.
We could say that this is a coincidence, but a more in-depth analysis reveals that these addresses belong to hosting companies from which you can rent a server and even several "C" networks.
I have observed similar cases with other scanners that search for DNS, SQL, RDP, HTTP, and other API services. When one of the IP addresses is blocked, another one from the same network is activated, and within a few minutes, over 40% of the "C" network is on the scanner list, and within an hour, sometimes 5-7 "C" networks coming from 1 hosting company
It is not a bad idea to combine proven "C" or "B" networks with over 30% of addresses. This will reduce many of the records, and instead of 240,000 records, we can reduce the number to much less.
When examining the addresses, one common feature stands out over 30% of the addresses on the same "C" network are on the lists.
We could say that this is a coincidence, but a more in-depth analysis reveals that these addresses belong to hosting companies from which you can rent a server and even several "C" networks.
I have observed similar cases with other scanners that search for DNS, SQL, RDP, HTTP, and other API services. When one of the IP addresses is blocked, another one from the same network is activated, and within a few minutes, over 40% of the "C" network is on the scanner list, and within an hour, sometimes 5-7 "C" networks coming from 1 hosting company
It is not a bad idea to combine proven "C" or "B" networks with over 30% of addresses. This will reduce many of the records, and instead of 240,000 records, we can reduce the number to much less.