Based on some very rough sampling, a significant majority of the addresses allocated to VDC in the 123.16/16 network reverse resolve to localhost. This appears to be intended behavior, and accounts for ~70% of the numbers in the Shodan report.<p><pre><code> $ dig @8.8.8.8 -x 123.16.0.0
; <<>> DiG 9.8.3-P1 <<>> @8.8.8.8 -x 123.16.0.0
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29897
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;0.0.16.123.in-addr.arpa. IN PTR
;; ANSWER SECTION:
0.0.16.123.in-addr.arpa. 21265 IN PTR localhost.
;; Query time: 64 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Feb 18 08:14:37 2015
;; MSG SIZE rcvd: 64
$
</code></pre>
In fact, if you go through the list of networks advertised by AS45899 [1], I imagine that you'd find this is the case for quite a few of them. A quick look indicates this to be true.<p>[1]: <a href="http://bgp.he.net/AS45899#_prefixes" rel="nofollow">http://bgp.he.net/AS45899#_prefixes</a>