This is a dark art, and many of the sources are shady as fuck! We often have no idea of their methodology. Also no source is fully complete. We just piece up as best we can.

Some links of interest:
* https://bushart.org/topic/ip
* https://archive.org/details/internet-mapping
* https://stackoverflow.com/questions/307553/possible-to-download-entire-whois-database-list-of-registered-domains (deleted question, see archives)
* https://www.reversedns.ch/en/ has some OK reverse IPs, but you have to do them one by one with CAPTCHA, and we were already past that point when that source was found, so nothing new was found on it yet
* https://www.zone-h.org/archive/ip=208.76.80.93/page=11?hz=1 mentions `newsupdatesite.com` and mentions "defacement", the <"Mass Deface III" pastebin> comes to mind. No other nearby hits on quick inspection.


 Data sources