It indicates that the IP address shows inconsistencies between registry information and observed geolocation data, such as mismatched registered countries or region-level discrepancies.
Three questions every analyst asks before acting on this signal.
It indicates that the IP address shows inconsistencies between registry information and observed geolocation data, such as mismatched registered countries or region-level discrepancies.
Examples include registered country mismatches, conflicts between RIR country data and real-time geolocation, or cross-region discrepancies where the IP appears in an unexpected or unrelated geographic region.
This is a supporting malicious indicator. While not conclusive on its own, persistent geo-alignment conflicts often appear in evasive infrastructures such as proxy farms, anonymization layers, misregistered resources or abused hosting providers.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "ip_geo_alignment_conflict",
"name": "Geolocation Alignment Conflict",
"group": "dns_history",
"subgroup": "ip_geolocation_profile",
"direction": "malicious",
"evidence": {
"current_countries": [
"US"
],
"historical_countries": [
"US",
"DE",
"TR"
],
"geo_consistency_score": 0.92,
"eu_false_flag_risk": false
}
}9 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that all currently active IP addresses of a domain are geographically concentrated in a single location sco…
It indicates that the geolocation of the domain’s currently active IP addresses is consistent with the geolocations obse…
It indicates that the geolocation of the domain’s currently active IP addresses significantly differs from the geolocati…
It indicates that the IP address is consistently hosted within EU regions known for strict regulatory, privacy and opera…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.