The largest subnet the bouncer is willing to consider as potentially
malicious. Decisions with a larger subnet (smaller mask) are ignored.
Real-world malicious blocks are almost always single IPs : a datacenter
hosts abusive customers but the whole datacenter is rarely banned. Checking
country-sized blocks is an extreme edge case, so this lets the operator
choose how far up the prefix hierarchy to look.
The largest subnet the bouncer is willing to consider as potentially malicious. Decisions with a larger subnet (smaller mask) are ignored.
Real-world malicious blocks are almost always single IPs : a datacenter hosts abusive customers but the whole datacenter is rarely banned. Checking country-sized blocks is an extreme edge case, so this lets the operator choose how far up the prefix hierarchy to look.