Skip to content

Country-Level IP Geolocation Centralization

It indicates that all currently active IP addresses of a domain are geographically concentrated in a single location scope, typically within one country.

See verdicts firing this signalOpen in API reference
Also surfaces as:
Continent-Level IP Geolocation Centralization
Analyst Q&A

What this signal answers

Three questions every analyst asks before acting on this signal.

What it detects01

What does 'Current IP Geolocation Centralization' indicate?

It indicates that all currently active IP addresses of a domain are geographically concentrated in a single location scope, typically within one country.

Why it matters02

How is this different from geolocation stability?

This label is snapshot-based and reflects only the current infrastructure layout. It does not imply long-term stability or historical persistence.

How analysts use it03

How should analysts interpret this label?

This is a safe-bias contextual indicator. Centralized current infrastructure is common for many legitimate services, but it should be evaluated alongside historical and behavioral signals.

Evidence shape

What Country-Level IP Geolocation Centralization looks like in the response

A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.

json
{
  "slug": "current_ips_geo_centralization",
  "name": "Country-Level IP Geolocation Centralization",
  "group": "dns_history",
  "subgroup": "ip_geolocation_profile",
  "direction": "safe",
  "evidence": {
    "current_countries": [
      "US"
    ],
    "historical_countries": [
      "US",
      "DE",
      "TR"
    ],
    "geo_consistency_score": 0.92,
    "eu_false_flag_risk": false
  }
}
See in API reference
Siblings

Peers in IP Geolocation Profile

9 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.

Current and Historical Geolocation Alignment

It indicates that the geolocation of the domain’s currently active IP addresses is consistent with the geolocations obse…

Safe
Large-Scale Multi-Country IP Distribution

It indicates that a domain operates a large number of currently active IP addresses distributed across multiple countrie…

Safe
Single DC Hub Footprint

It indicates that the IP address belongs to data center or hosting infrastructure and describes the current geographic f…

Safe
Small-Scale Multi-Country IP Dispersion

It indicates that a domain has a small number of currently active IP addresses that are distributed across multiple coun…

Malicious
Show 5 more in IP Geolocation Profile
In the wild

See Country-Level IP Geolocation Centralization fire on real IOCs

The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.

Open Verdict Gallery
Pre-filtered to Country-Level IP Geolocation Centralization. See real IOCs this signal caught and the verdicts the engine returned.
Verdicts ✓

Start free, in five minutes

100 IOCs/day on the free tier, LLM layer included. No card required.

Get an API keyBack to IP Geolocation Profile