Systems and methods for IP mass host verification

A system comprising:

• a processor coupled to a memory that stores one or more instructions, the instructions executable by the processor to perform:
• selecting a first candidate Internet Protocol (IP) address;
• identifying a plurality of domains hosted at the first candidate IP address;
• identifying one or more registrants of the plurality of domains;
• determining a number of unique registrants within the one or more registrants of the plurality of domains;
• determining that the number of unique registrants exceeds a threshold number;
• and
• in response to determining that the number of unique registrants exceeds the threshold number,
• identifying ones of the plurality of domains that have bad reputations,
• determining that the identified ones of the plurality of domains that have bad reputations comprise at least a threshold percentage of the plurality of domains, and
• in response to determining that the identified ones of the plurality of domains that have bad reputations comprise at least the threshold percentage of the plurality of domains, storing an indication that the first candidate IP address is a bad mass host.

A computer program product comprising a non-transitory computer-readable medium storing instructions executable by one or more processors to perform:

• selecting a first candidate Internet Protocol (IP) address;
• identifying a plurality of domains hosted at the first candidate IP address;
• identifying one or more registrants of the plurality of domains;
• determining a number of unique registrants within the one or more registrants of the plurality of domains;
• determining that the number of unique registrants exceeds a threshold number;
• and
• in response to determining that the number of unique registrants exceeds the threshold number,
• identifying ones of the plurality of domains that have bad reputations,
• determining that the identified ones of the plurality of domains that have bad reputations comprise at least a threshold percentage of the plurality of domains, and
• in response to determining that the identified ones of the plurality of domains that have bad reputations comprise at least the threshold percentage of the plurality of domains, storing an indication that the first candidate IP address is a bad mass host.