Maybe not that many, but still a lot more, if you first looked at BGP, and only brute-forced networks that were routable, rather than the entire search space.

Maybe not that many, but still a lot more, if you first looked at BGP, and only brute-forced networks that were routable, rather than the entire search space. Basically, before scanning, query and iterate all ASes advertisments and union present ranges, then feed that to zmap or something that can scan IPv4 and/or IPv6.