<b>The Class C subnet check almost nobody runs anymore</b>

<b>The Class C subnet check almost nobody runs anymore</b>

Word is link networks got lazy again. Everyone obsesses over DR and forgets to look at WHERE the donors are hosted — and the subnet clustering is back to being a dead giveaway.

The teardown:
— Pull referring IPs and group by Class C subnet (the first three octets)
— A natural profile spreads across hundreds of unrelated subnets and hosts
— A network shows 15-30 'different' domains all sitting on the same 2-3 subnets, often the same budget host
— Bonus tell: same nameservers, same registrar privacy service, registration dates within the same month

Multiple profiles that present 200 referring domains collapse to maybe 40 real networks once you dedupe by subnet and owner. The DR count was theater. Google's been able to see the hosting overlap for fifteen years — so can you, for the price of one export. Watch this space.