It indicates that the IP address belongs to a large-scale, long-established, and officially allocated enterprise network. Such IP blocks are typically owned by major cloud providers, telecom operators, or long-standing organizations and are rarely associated with disposable or malicious infrastructure.
Three questions every analyst asks before acting on this signal.
It indicates that the IP address belongs to a large-scale, long-established, and officially allocated enterprise network. Such IP blocks are typically owned by major cloud providers, telecom operators, or long-standing organizations and are rarely associated with disposable or malicious infrastructure.
Enterprise IP blocks require significant operational cost, long-term registry presence, and strict abuse monitoring. Threat actors typically avoid these environments due to higher detection risk, contractual enforcement, and limited anonymity.
This label provides strong positive context but should not override high-confidence malicious signals. It is best used as a stabilizing signal to reduce false positives when correlated with DNS stability, SSL validity, and traffic consistency.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "ip_block_enterprise_allocation",
"name": "Large-Scale Enterprise IP Block",
"group": "dns_history",
"subgroup": "ip_registry_allocation_profile",
"direction": "safe",
"evidence": {
"registry": "ARIN",
"allocation_class": "datacenter",
"cidr": "104.21.0.0/16",
"allocation_recency_days": 1340,
"block_risk": "low"
}
}5 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the IP block has the RIR status 'assigned', which is commonly associated with end-user or reseller add…
It means the IP block was assigned in a very recent time window. Newly allocated address space is frequently observed in…
It indicates that the delegated registry CIDR fully matches the geolocation CIDR, meaning the entire IP block consistent…
It indicates that a small-sized IP prefix shows a concentration of malicious activity, such as repeated blacklist hits, …
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.