> I'd bet that almost all don't have three numbers all the same and that there are probably more rules/conventions that would reduce the search space.

You're correct that almost all don't have three identical digits, but that's just because there's only 10 of them -

000, 111, 222, 333, 444, 555, 666, 777, 888, 999

10/1000 = 1%

I doubt they would make up rules for determining the cvv, as it would only improve security until bad actors could determine the rules - then it would hinder security as there would be less entropy in the selection space.

I think they can be same, but they always > 99 (at least I never saw a card with CVV starting with 0)

A coworker of mine thought the same. Parsed the string into an int - we saw a bunch of cards get declined by our gateway processing company. They definitely can have leading zeroes.

I have, it was a Visa.

I had a card one that was three of the same. Obviously an anecdote, though.