It indicates that the delegated registry CIDR fully matches the geolocation CIDR, meaning the entire IP block consistently maps to a single country or region with no fragmentation.
The questions every analyst asks before acting on this signal.
It indicates that the delegated registry CIDR fully matches the geolocation CIDR, meaning the entire IP block consistently maps to a single country or region with no fragmentation.
Blocks that remain unfragmented and tied to a single region for long periods typically belong to stable operators. Such blocks show low churn and minimal abuse activity across time.
This is a supportive safe-bias signal. While not sufficient to classify a domain or IP as definitively benign, it adds environmental confidence when combined with other stable or long-term infrastructure signals.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "ip_registry_geo_cidr_full_match",
"name": "Registry–Geo CIDR Full Match",
"group": "dns_history",
"subgroup": "ip_registry_allocation_profile",
"direction": "safe",
"evidence": {
"registry": "ARIN",
"allocation_class": "datacenter",
"cidr": "104.21.0.0/16",
"allocation_recency_days": 1340,
"block_risk": "low"
}
}5 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the IP address belongs to a large-scale, long-established, and officially allocated enterprise network…
It indicates that the IP block has the RIR status 'assigned', which is commonly associated with end-user or reseller add…
It means the IP block was assigned in a very recent time window. Newly allocated address space is frequently observed in…
It indicates that a small-sized IP prefix shows a concentration of malicious activity, such as repeated blacklist hits, …
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
avmptt[.]comSuspicious64Verified 2026-08-01dns-cloud[.]netSuspicious60Verified 2026-08-01etik-cloud[.]comSuspicious65Verified 2026-08-01accountaccess[.]orgSuspicious65Verified 2026-08-01faqserv[.]comSuspicious66Verified 2026-08-01crzg[.]com[.]cnSuspicious66Verified 2026-08-01070962[.]xyzSuspicious64Verified 2026-08-01follower[.]geSuspicious63Verified 2026-08-01ahm-jp[.]proSuspicious63Verified 2026-08-01allowandgo[.]comSuspicious65Verified 2026-08-014bike[.]netSuspicious67Verified 2026-08-01cs-coin[.]linkHigh76Verified 2026-08-01brandwizer[.]co[.]inSuspicious68Verified 2026-08-01bih[.]comSuspicious60Verified 2026-08-01fastred[.]bizSuspicious73Verified 2026-08-01atomochabits[.]comSuspicious67Verified 2026-08-01fidelityschedule[.]comSuspicious70Verified 2026-08-01dantbritingd[.]clubSuspicious62Verified 2026-08-01exrap[.]comSuspicious64Verified 2026-08-01atalaianet[.]net[.]brSuspicious61Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.