What it detects01
What does the 'IP Geo DC Hub' label indicate?
It indicates that the IP address belongs to data center or hosting infrastructure and describes the current geographic footprint of that infrastructure based on observed IP locations.
Single DC Hub Footprint
It indicates that the IP address belongs to data center or hosting infrastructure and describes the current geographic footprint of that infrastructure based on observed IP locations.
Also surfaces as:
Regional DC Cluster FootprintGlobal DC Footprint
Analyst Q&A
What this signal answers
Three questions every analyst asks before acting on this signal.
Why it matters02
How are the different DC hub sublabels determined?
The sublabels represent the geographic distribution of the domain’s active data center IPs: a single hub when all IPs are located in one country, a regional cluster when IPs span multiple countries within the same continent, and a global footprint when IPs are distributed across multiple continents.
How analysts use it03
How should analysts interpret this label?
This is a contextual infrastructure label. It does not indicate malicious or benign behavior on its own but helps analysts understand whether the domain operates from a localized, regional, or globally distributed data center environment.
Evidence shape
What Single DC Hub Footprint looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "ip_geo_dc_hub",
"name": "Single DC Hub Footprint",
"group": "dns_history",
"subgroup": "ip_geolocation_profile",
"direction": "safe",
"evidence": {
"current_countries": [
"US"
],
"historical_countries": [
"US",
"DE",
"TR"
],
"geo_consistency_score": 0.92,
"eu_false_flag_risk": false
}
}Siblings
Peers in IP Geolocation Profile
9 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
Country-Level IP Geolocation Centralization
It indicates that all currently active IP addresses of a domain are geographically concentrated in a single location sco…
Safe
Current and Historical Geolocation Alignment
It indicates that the geolocation of the domain’s currently active IP addresses is consistent with the geolocations obse…
Safe
Current and Historical Geolocation Divergence
It indicates that the geolocation of the domain’s currently active IP addresses significantly differs from the geolocati…
Malicious
EU Compliance Location
It indicates that the IP address is consistently hosted within EU regions known for strict regulatory, privacy and opera…
Safe
In the wild
See Single DC Hub Footprint fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Open Verdict Gallery
Pre-filtered to Single DC Hub Footprint. See real IOCs this signal caught and the verdicts the engine returned.
Start free, in five minutes
100 IOCs/day on the free tier, LLM layer included. No card required.