It indicates that the domain operates across multiple IP addresses simultaneously. This is commonly seen in legitimate services such as global organizations, CDNs, or enterprise-grade platforms that distribute their load geographically or for redundancy.
Three questions every analyst asks before acting on this signal.
It indicates that the domain operates across multiple IP addresses simultaneously. This is commonly seen in legitimate services such as global organizations, CDNs, or enterprise-grade platforms that distribute their load geographically or for redundancy.
Managing and maintaining multiple IPs requires technical resources, investment, and infrastructure maturity. Legitimate companies often use multi-IP architectures to ensure uptime, balance network load, and improve user experience, which is rarely the case for short-lived malicious domains.
If the IPs belong to reputable ASNs, are consistent over time, and serve legitimate content, the domain’s multi-IP pattern is a strong positive signal of organizational stability rather than malicious intent.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "active_alot_of_ip",
"name": "Multi-IP Infrastructure Detected",
"group": "dns_history",
"subgroup": "ip_diversity_rotation",
"direction": "safe",
"evidence": {
"distinct_ips_30d": 47,
"rotation_period_hours": 6,
"geo_distribution": [
"US",
"RU",
"VN"
],
"fast_flux_score": 0.81
}
}2 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It means the domain operates with a large number of well-organized and active subdomains. This is typical for legitimate…
It indicates that multiple subdomains of the same domain are actively served through a shared IP address over a long per…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.