@kensanata I've long found clustering by ASN & CIDR block to be far more revealing.

https://www.routeviews.org

Reverse IP to CIDR & ASN lookup.

Crawl bots tend to work out of nonresidential contiguous IP space, though AWS and Tor modify that somewhat.

#WebserverLogs
#asn
#cidr
#routeviews

@edsu