It indicates that multiple subdomains of the same domain are actively served through a shared IP address over a long period. This configuration is commonly used in well-managed environments to simplify routing, reduce costs, and improve infrastructure stability.
Three questions every analyst asks before acting on this signal.
It indicates that multiple subdomains of the same domain are actively served through a shared IP address over a long period. This configuration is commonly used in well-managed environments to simplify routing, reduce costs, and improve infrastructure stability.
Long-term reuse of the same IP across multiple subdomains usually reflects consistency in hosting and DNS management. It suggests that the domain belongs to an organized infrastructure — such as enterprise systems, SaaS environments, or centralized service networks.
When observed alongside reputable ASN ownership, stable uptime, and legitimate SSL usage, this pattern reinforces trust in the domain’s integrity and reliability rather than indicating malicious intent.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "active_alot_of_ip_subdomain",
"name": "Centralized IP-Subdomain Infrastructure Detected",
"group": "dns_history",
"subgroup": "ip_diversity_rotation",
"direction": "safe",
"evidence": {
"distinct_ips_30d": 47,
"rotation_period_hours": 6,
"geo_distribution": [
"US",
"RU",
"VN"
],
"fast_flux_score": 0.81
}
}2 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It means the domain operates with a large number of well-organized and active subdomains. This is typical for legitimate…
It indicates that the domain operates across multiple IP addresses simultaneously. This is commonly seen in legitimate s…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.