It indicates that a small-sized IP prefix shows a concentration of malicious activity, such as repeated blacklist hits, high-risk domain density, or rapid domain churn, suggesting abuse within the allocation.
The questions every analyst asks before acting on this signal.
It indicates that a small-sized IP prefix shows a concentration of malicious activity, such as repeated blacklist hits, high-risk domain density, or rapid domain churn, suggesting abuse within the allocation.
Small allocations are often inexpensive, easy to acquire and frequently used for short-lived or disposable malicious operations. When combined with observed abuse activity, they provide a strong malicious signal.
It is a meaningful malicious infrastructure signal. While prefix size alone is not risky, the presence of abuse patterns in a small allocation strongly suggests misuse and should elevate investigation priority.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "ip_registry_small_prefix_high_abuse_pattern",
"name": "Small Allocation Abuse Pattern",
"group": "dns_history",
"subgroup": "ip_registry_allocation_profile",
"direction": "malicious",
"evidence": {
"registry": "ARIN",
"allocation_class": "datacenter",
"cidr": "104.21.0.0/16",
"allocation_recency_days": 1340,
"block_risk": "low"
}
}5 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the IP block allocated to the ASN is unusually small. Very small prefixes are frequently observed in l…
It indicates that the IP block has the RIR status 'assigned', which is commonly associated with end-user or reseller add…
It means the IP block was assigned in a very recent time window. Newly allocated address space is frequently observed in…
It indicates that the IP address belongs to a large-scale, long-established, and officially allocated enterprise network…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
avmiss[.]xyzSuspicious65Verified 2026-08-01droppin[.]siteSuspicious60Verified 2026-08-01dropps[.]coSuspicious60Verified 2026-08-01droppy[.]xyzSuspicious63Verified 2026-08-01allisonmanagementservices[.]comSuspicious66Verified 2026-08-01atomcareer[.]comSuspicious63Verified 2026-08-01click2[.]clubSuspicious60Verified 2026-08-01bity[.]wsSuspicious63Verified 2026-08-01follower[.]geSuspicious63Verified 2026-08-01bigolov[.]comSuspicious67Verified 2026-08-01fuckgaypornvideos[.]clickSuspicious65Verified 2026-08-01alleviatepracticableaddicted[.]comSuspicious63Verified 2026-08-01fullhdizle[.]ccSuspicious61Verified 2026-08-01ahoravideo-cdn[.]xyzSuspicious64Verified 2026-08-01checkass[.]monsterSuspicious67Verified 2026-08-0178mbt[.]buzzSuspicious60Verified 2026-08-01allisontravels[.]comSuspicious64Verified 2026-08-01getibo[.]comSuspicious63Verified 2026-08-01datlngllfe[.]netSuspicious71Verified 2026-08-01accountaccess[.]orgSuspicious65Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.