It indicates that the ASN shows geolocation anomalies, such as a mismatch between registry country and observed country or continent, or that it is associated with a country known for elevated abuse or weak hosting controls.
Three questions every analyst asks before acting on this signal.
It indicates that the ASN shows geolocation anomalies, such as a mismatch between registry country and observed country or continent, or that it is associated with a country known for elevated abuse or weak hosting controls.
Individual conditions such as registry-versus-observed country mismatch, continent mismatch and high-risk country flags are exposed as key–value fields in the evidence details instead of separate sublabels, so analysts can see exactly which geo anomalies are present.
It is a contextual malicious indicator that strengthens suspicion when combined with other signals such as blacklist hits, domain churn or suspicious hosting patterns. On its own it does not prove compromise, but it increases the likelihood that the ASN participates in risky or evasive infrastructure.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "asn_geo_risk_profile",
"name": "Geolocation Mismatch or High-Risk Region",
"group": "dns_history",
"subgroup": "asn_infrastructure_profile",
"direction": "malicious",
"evidence": {
"asn": "AS13335",
"asn_org": "Cloudflare, Inc.",
"asn_allocation_year": 2010,
"asn_geo_risk": "low",
"hosted_domain_count": 18420315
}
}13 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the ASN belongs to hosting environments statistically associated with higher abuse rates, weak onboard…
It indicates that domains hosted under this ASN have been involved in malware distribution, payload hosting, or command-…
It means that the ASN was allocated many years ago and has a long operational history. Older ASNs tend to be more stable…
It indicates that one or more domains hosted under the ASN use top-level domains statistically associated with abuse, su…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.