Skip to content

Geo-Registry Country Mismatch

The IP's geolocation doesn't match the RIR allocation country.

See verdicts firing this signalOpen in API reference
Also surfaces as:
Geo-Registry Mismatch (CDN Expected)
Analyst Q&A

What this signal answers

The questions every analyst asks before acting on this signal.

What it detects01

What does 'Geo-Registry Country Mismatch' mean?

The IP's geolocation doesn't match the RIR allocation country.

Why it matters02

How should analysts act on this?

Check if the IP belongs to a known CDN or cloud provider.

Often paired with:alert_only
Evidence shape

What Geo-Registry Country Mismatch looks like in the response

A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.

json
{
  "slug": "ip_geo_registry_mismatch",
  "name": "Geo-Registry Country Mismatch",
  "group": "dns_history",
  "subgroup": "ip_geolocation_profile",
  "direction": "malicious",
  "evidence": {
    "current_countries": [
      "US"
    ],
    "historical_countries": [
      "US",
      "DE",
      "TR"
    ],
    "geo_consistency_score": 0.92,
    "eu_false_flag_risk": false
  }
}
See in API reference
Siblings

Peers in IP Geolocation Profile

14 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.

Geo-ASN Country Mismatch

The IP's geolocation country doesn't match the ASN's registered country.

Malicious
Geo-Registered Country Mismatch

The IP's geolocation country doesn't match the domain's WHOIS registered country.

Malicious
Country-Level IP Geolocation Centralization

It indicates that all currently active IP addresses of a domain are geographically concentrated in a single location sco…

Safe
Current and Historical Geolocation Alignment

It indicates that the geolocation of the domain’s currently active IP addresses is consistent with the geolocations obse…

Safe
Show 10 more in IP Geolocation Profile
In the wild

See Geo-Registry Country Mismatch fire on real IOCs

The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.

Open Verdict Gallery
Pre-filtered to Geo-Registry Country Mismatch. See real IOCs this signal caught and the verdicts the engine returned.
Verdicts ✓

Latest reports carrying this signal

Start free, in five minutes

1,000 verdicts/month on the free tier, LLM layer included. No card required.

Get an API keyBack to IP Geolocation Profile