diff --git a/report/networks.go b/report/networks.go
index 751b67dcd..ae0e4148a 100644
--- a/report/networks.go
+++ b/report/networks.go
@@ -114,15 +114,20 @@ func ContainingIPv4Network(ips []net.IP) *net.IPNet {
 	if len(ips) == 0 {
 		return nil
 	}
-	network := net.IPNet{
-		IP:   ips[0],
-		Mask: net.CIDRMask(net.IPv4len*8, net.IPv4len*8),
-	}
+	cpl := net.IPv4len * 8
+	network := networkFromPrefix(ips[0], cpl)
 	for _, ip := range ips[1:] {
-		network.Mask = net.CIDRMask(commonIPv4PrefixLen(network.IP, ip), net.IPv4len*8)
-		network.IP = network.IP.Mask(network.Mask)
+		if ncpl := commonIPv4PrefixLen(network.IP, ip); ncpl < cpl {
+			cpl = ncpl
+			network = networkFromPrefix(network.IP, cpl)
+		}
 	}
-	return &network
+	return network
+}
+
+func networkFromPrefix(ip net.IP, prefixLen int) *net.IPNet {
+	mask := net.CIDRMask(prefixLen, net.IPv4len*8)
+	return &net.IPNet{IP: ip.Mask(mask), Mask: mask}
 }
 
 func commonIPv4PrefixLen(a, b net.IP) int {
diff --git a/report/networks_test.go b/report/networks_test.go
index 82af2bcd6..6763b317b 100644
--- a/report/networks_test.go
+++ b/report/networks_test.go
@@ -29,6 +29,7 @@ func TestContainingIPv4Network(t *testing.T) {
 	assert.Nil(t, containingIPv4Networks([]string{}))
 	assert.Equal(t, "10.0.0.1/32", containingIPv4Networks([]string{"10.0.0.1"}).String())
 	assert.Equal(t, "10.0.0.0/17", containingIPv4Networks([]string{"10.0.0.1", "10.0.2.55", "10.0.106.48"}).String())
+	assert.Equal(t, "10.0.0.0/16", containingIPv4Networks([]string{"10.0.128.1", "10.0.0.1", "10.0.0.2"}).String())
 	assert.Equal(t, "0.0.0.0/0", containingIPv4Networks([]string{"10.0.0.1", "192.168.0.1"}).String())
 }