It indicates that the IP block has the RIR status 'assigned', which is commonly associated with end-user or reseller address space that frequently changes hands and exhibits higher abuse rates than allocated provider blocks.
The questions every analyst asks before acting on this signal.
It indicates that the IP block has the RIR status 'assigned', which is commonly associated with end-user or reseller address space that frequently changes hands and exhibits higher abuse rates than allocated provider blocks.
Assigned blocks are often leased, suballocated, or transferred more frequently. This leads to weak ownership continuity, limited operational oversight, and a higher likelihood of appearing in phishing, spam or malware-related activity.
Assigned block status is a meaningful malicious-leaning indicator. While not conclusive on its own, it becomes significant when combined with recent reallocation, small prefix size, blacklist activity or risky ASN/domain behavior.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "ip_registry_assigned_block_risk",
"name": "Assigned IP Block",
"group": "dns_history",
"subgroup": "ip_registry_allocation_profile",
"direction": "malicious",
"evidence": {
"registry": "ARIN",
"allocation_class": "datacenter",
"cidr": "104.21.0.0/16",
"allocation_recency_days": 1340,
"block_risk": "low"
}
}5 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It means the IP block was assigned in a very recent time window. Newly allocated address space is frequently observed in…
It indicates that a small-sized IP prefix shows a concentration of malicious activity, such as repeated blacklist hits, …
It indicates that the IP block allocated to the ASN is unusually small. Very small prefixes are frequently observed in l…
It indicates that the IP address belongs to a large-scale, long-established, and officially allocated enterprise network…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
das-oktoberfest[.]orgSuspicious63Verified 2026-08-01atomcareer[.]comSuspicious63Verified 2026-08-01express-new[.]comSuspicious65Verified 2026-08-01biollet[.]comSuspicious68Verified 2026-08-01fedoq[.]comSuspicious62Verified 2026-08-01excursiionline[.]roSuspicious64Verified 2026-08-01dpages[.]siteSuspicious64Verified 2026-08-01071433[.]xyzSuspicious64Verified 2026-08-01follower[.]geSuspicious63Verified 2026-08-01datlngllfe[.]netSuspicious71Verified 2026-08-01broworker10s[.]comSuspicious65Verified 2026-08-01crzz2[.]boatsSuspicious64Verified 2026-08-0178ff338c8bc9cec4db77a5b04b3713bf[.]topHigh77Verified 2026-08-01clickstat360[.]comSuspicious63Verified 2026-08-01dropps[.]coSuspicious60Verified 2026-08-01archa[.]xyzSuspicious62Verified 2026-08-01bigolov[.]comSuspicious67Verified 2026-08-01fullhdfilmizles[.]orgSuspicious63Verified 2026-08-01dp67161914[.]comSuspicious61Verified 2026-08-01boheme[.]studioSuspicious71Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.