It indicates that the domain operates across multiple IP addresses simultaneously. This is commonly seen in legitimate services such as global organizations, CDNs, or enterprise-grade platforms that distribute their load geographically or for redundancy.
The questions every analyst asks before acting on this signal.
It indicates that the domain operates across multiple IP addresses simultaneously. This is commonly seen in legitimate services such as global organizations, CDNs, or enterprise-grade platforms that distribute their load geographically or for redundancy.
Managing and maintaining multiple IPs requires technical resources, investment, and infrastructure maturity. Legitimate companies often use multi-IP architectures to ensure uptime, balance network load, and improve user experience, which is rarely the case for short-lived malicious domains.
If the IPs belong to reputable ASNs, are consistent over time, and serve legitimate content, the domain’s multi-IP pattern is a strong positive signal of organizational stability rather than malicious intent.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "active_alot_of_ip",
"name": "Multi-IP Infrastructure Detected",
"group": "dns_history",
"subgroup": "ip_diversity_rotation",
"direction": "safe",
"evidence": {
"distinct_ips_30d": 47,
"rotation_period_hours": 6,
"geo_distribution": [
"US",
"RU",
"VN"
],
"fast_flux_score": 0.81
}
}2 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It means the domain operates with a large number of well-organized and active subdomains. This is typical for legitimate…
It indicates that multiple subdomains of the same domain are actively served through a shared IP address over a long per…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
dnspark[.]inSuspicious62Verified 2026-08-01cinemap[.]ccSuspicious61Verified 2026-08-01atalaianet[.]net[.]brSuspicious61Verified 2026-08-01fibranetbrasil[.]net[.]brSuspicious62Verified 2026-08-01etik-cloud[.]comSuspicious65Verified 2026-08-01edgecache[.]xyzSuspicious66Verified 2026-08-01aliyunga0017[.]comSuspicious62Verified 2026-08-01fastfetch[.]xyzSuspicious68Verified 2026-08-01emailbounce[.]nlSuspicious60Verified 2026-08-01awandata[.]ccSuspicious61Verified 2026-08-01birdseyewings[.]coSuspicious64Verified 2026-08-01cachequick[.]xyzSuspicious69Verified 2026-08-01cherryservers[.]netSuspicious62Verified 2026-08-01emailpro[.]vnSuspicious60Verified 2026-08-01articles[.]skSuspicious60Verified 2026-08-01deltainternet[.]net[.]brSuspicious62Verified 2026-08-01as262543[.]net[.]brSuspicious63Verified 2026-08-01cdnfree[.]orgSuspicious66Verified 2026-08-01cifo[.]co[.]idSuspicious63Verified 2026-08-01eboz[.]comSuspicious60Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.