Skip to content

Geo-ASN Country Mismatch

The IP's geolocation country doesn't match the ASN's registered country.

See verdicts firing this signalOpen in API reference
Also surfaces as:
Geo-ASN Mismatch (CDN Expected)
Analyst Q&A

What this signal answers

The questions every analyst asks before acting on this signal.

What it detects01

What does 'Geo-ASN Country Mismatch' mean?

The IP's geolocation country doesn't match the ASN's registered country.

Why it matters02

Is this always suspicious?

Not necessarily, global cloud providers routinely announce IPs from various countries.

Often paired with:alert_only
Evidence shape

What Geo-ASN Country Mismatch looks like in the response

A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.

json
{
  "slug": "ip_geo_asn_mismatch",
  "name": "Geo-ASN Country Mismatch",
  "group": "dns_history",
  "subgroup": "ip_geolocation_profile",
  "direction": "malicious",
  "evidence": {
    "current_countries": [
      "US"
    ],
    "historical_countries": [
      "US",
      "DE",
      "TR"
    ],
    "geo_consistency_score": 0.92,
    "eu_false_flag_risk": false
  }
}
See in API reference
Siblings

Peers in IP Geolocation Profile

14 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.

Geo-Registered Country Mismatch

The IP's geolocation country doesn't match the domain's WHOIS registered country.

Malicious
Geo-Registry Country Mismatch

The IP's geolocation doesn't match the RIR allocation country.

Malicious
Country-Level IP Geolocation Centralization

It indicates that all currently active IP addresses of a domain are geographically concentrated in a single location sco…

Safe
Current and Historical Geolocation Alignment

It indicates that the geolocation of the domain’s currently active IP addresses is consistent with the geolocations obse…

Safe
Show 10 more in IP Geolocation Profile
In the wild

See Geo-ASN Country Mismatch fire on real IOCs

The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.

Open Verdict Gallery
Pre-filtered to Geo-ASN Country Mismatch. See real IOCs this signal caught and the verdicts the engine returned.
Verdicts ✓

Latest reports carrying this signal

Start free, in five minutes

1,000 verdicts/month on the free tier, LLM layer included. No card required.

Get an API keyBack to IP Geolocation Profile