What it detects01
What does 'Registry–Geo CIDR Full Match' indicate?
It indicates that the delegated registry CIDR fully matches the geolocation CIDR, meaning the entire IP block consistently maps to a single country or region with no fragmentation.
Registry–Geo CIDR Full Match
It indicates that the delegated registry CIDR fully matches the geolocation CIDR, meaning the entire IP block consistently maps to a single country or region with no fragmentation.
Analyst Q&A
What this signal answers
Three questions every analyst asks before acting on this signal.
Why it matters02
Why is full CIDR geolocation alignment considered a safe signal?
Blocks that remain unfragmented and tied to a single region for long periods typically belong to stable operators. Such blocks show low churn and minimal abuse activity across time.
How analysts use it03
How should analysts interpret this indicator?
This is a supportive safe-bias signal. While not sufficient to classify a domain or IP as definitively benign, it adds environmental confidence when combined with other stable or long-term infrastructure signals.
Evidence shape
What Registry–Geo CIDR Full Match looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "ip_registry_geo_cidr_full_match",
"name": "Registry–Geo CIDR Full Match",
"group": "dns_history",
"subgroup": "ip_registry_allocation_profile",
"direction": "safe",
"evidence": {
"registry": "ARIN",
"allocation_class": "datacenter",
"cidr": "104.21.0.0/16",
"allocation_recency_days": 1340,
"block_risk": "low"
}
}Siblings
Peers in IP Registry Allocation Profile
5 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
Large-Scale Enterprise IP Block
It indicates that the IP address belongs to a large-scale, long-established, and officially allocated enterprise network…
SafeCore
Assigned IP Block
It indicates that the IP block has the RIR status 'assigned', which is commonly associated with end-user or reseller add…
Malicious
IP Block Recently Allocated
It means the IP block was assigned in a very recent time window. Newly allocated address space is frequently observed in…
Malicious
Small Allocation Abuse Pattern
It indicates that a small-sized IP prefix shows a concentration of malicious activity, such as repeated blacklist hits, …
Malicious
In the wild
See Registry–Geo CIDR Full Match fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Open Verdict Gallery
Pre-filtered to Registry–Geo CIDR Full Match. See real IOCs this signal caught and the verdicts the engine returned.
Start free, in five minutes
100 IOCs/day on the free tier, LLM layer included. No card required.