The C-class clustering that maps a private network

The C-class clustering that maps a private network

Here's an old-school read that still works. Networks try to look diverse by spreading sites across many domains. The hosting often gives them away.

Pull referring domains and map their IP ranges. When 60 'independent' sites linking to one target share a handful of C-class IP blocks, that's not coincidence — it's one operator who bought hosting in bulk.

— Smarter networks now spread across cloud providers to break the pattern, but cheap PBNs still cluster.
— Tell: same C-class plus same nameservers plus same theme template = a network you can fully enumerate.

Multiple profiles in spammier verticals still light up on IP-class analysis. The pros moved on; the bargain operators didn't.

Watch this space.