In this particular source data, all non-MIT IPs happened to start with 3 digits -- but this would not always be the case. 17.1.1.1 is a non-MIT IP and it would not be matched by this regex.