It means the IP block was assigned in a very recent time window. Newly allocated address space is frequently observed in malicious infrastructure setups due to its low historical footprint and limited traceability.
Three questions every analyst asks before acting on this signal.
It means the IP block was assigned in a very recent time window. Newly allocated address space is frequently observed in malicious infrastructure setups due to its low historical footprint and limited traceability.
Freshly assigned IP ranges are often used for short-lived hosting, phishing campaigns, fast-rotating C2 nodes, or infrastructure designed to evade historical reputation checks.
It is a supporting malicious signal. While not conclusive on its own, when a recently allocated block also shows suspicious hosting behavior, blacklist activity or unstable DNS patterns, the risk classification becomes significantly stronger.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "ip_block_recent_allocation_risk",
"name": "IP Block Recently Allocated",
"group": "dns_history",
"subgroup": "ip_registry_allocation_profile",
"direction": "malicious",
"evidence": {
"registry": "ARIN",
"allocation_class": "datacenter",
"cidr": "104.21.0.0/16",
"allocation_recency_days": 1340,
"block_risk": "low"
}
}5 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the IP block has the RIR status 'assigned', which is commonly associated with end-user or reseller add…
It indicates that a small-sized IP prefix shows a concentration of malicious activity, such as repeated blacklist hits, …
It indicates that the IP block allocated to the ASN is unusually small. Very small prefixes are frequently observed in l…
It indicates that the IP address belongs to a large-scale, long-established, and officially allocated enterprise network…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.