It indicates that the ASN has been allocated recently in the RIR system. Newly allocated ASNs often represent early-stage infrastructure, which is statistically more likely to be abused during initial setup phases.
Three questions every analyst asks before acting on this signal.
It indicates that the ASN has been allocated recently in the RIR system. Newly allocated ASNs often represent early-stage infrastructure, which is statistically more likely to be abused during initial setup phases.
Newly Allocated ASN Lifecycle reflects recent allocation with normal registry statuses such as assigned or allocated. Suspicious Newly Allocated ASN Lifecycle is triggered only when the ASN is newly allocated and exhibits abnormal registry statuses such as reserved, invalid, reclaimed, or withdrawn.
This is a weak malicious lifecycle signal and should not be treated as a standalone verdict. It gains significance only when correlated with independent indicators such as abuse reports, infrastructure churn, or risky ASN behavior.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "asn_new_allocation_lifecycle",
"name": "Newly Allocated ASN Lifecycle",
"group": "dns_history",
"subgroup": "asn_infrastructure_profile",
"direction": "malicious",
"evidence": {
"asn": "AS13335",
"asn_org": "Cloudflare, Inc.",
"asn_allocation_year": 2010,
"asn_geo_risk": "low",
"hosted_domain_count": 18420315
}
}13 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It means that the ASN was allocated many years ago and has a long operational history. Older ASNs tend to be more stable…
It indicates that the ASN belongs to hosting environments statistically associated with higher abuse rates, weak onboard…
It indicates that domains hosted under this ASN have been involved in malware distribution, payload hosting, or command-…
It means that one or more domains hosted under this ASN were registered very recently, which is a common trait of early-…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.