What it detects01
What does 'Small IP Block Allocation' indicate?
It indicates that the IP block allocated to the ASN is unusually small. Very small prefixes are frequently observed in low-governance, disposable or abuse-prone hosting environments.
Small IP Block Allocation
It indicates that the IP block allocated to the ASN is unusually small. Very small prefixes are frequently observed in low-governance, disposable or abuse-prone hosting environments.
Analyst Q&A
What this signal answers
The questions every analyst asks before acting on this signal.
Why it matters02
Why is small prefix size considered a risk factor?
Threat actors often use small allocations because they are cheap, easy to acquire and provide limited historical footprint, making detection and attribution more difficult.
How analysts use it03
How should analysts interpret this indicator?
This is a supporting malicious indicator. While a small allocation alone does not confirm abuse, it becomes meaningful when combined with other signals such as recent allocation, blacklist activity or unstable infrastructure patterns.
Often paired with:alert_only
Evidence shape
What Small IP Block Allocation looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "ip_block_small_size_risk",
"name": "Small IP Block Allocation",
"group": "dns_history",
"subgroup": "ip_registry_allocation_profile",
"direction": "malicious",
"evidence": {
"registry": "ARIN",
"allocation_class": "datacenter",
"cidr": "104.21.0.0/16",
"allocation_recency_days": 1340,
"block_risk": "low"
}
}Siblings
Peers in IP Registry Allocation Profile
5 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
Small Allocation Abuse Pattern
It indicates that a small-sized IP prefix shows a concentration of malicious activity, such as repeated blacklist hits, …
Malicious
Assigned IP Block
It indicates that the IP block has the RIR status 'assigned', which is commonly associated with end-user or reseller add…
Malicious
IP Block Recently Allocated
It means the IP block was assigned in a very recent time window. Newly allocated address space is frequently observed in…
Malicious
Large-Scale Enterprise IP Block
It indicates that the IP address belongs to a large-scale, long-established, and officially allocated enterprise network…
SafeCore
In the wild
See Small IP Block Allocation fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Open Verdict Gallery
Pre-filtered to Small IP Block Allocation. See real IOCs this signal caught and the verdicts the engine returned.
Latest reports carrying this signal
22238[.]netSuspicious60Verified 2026-08-01aflirty[.]comSuspicious68Verified 2026-08-01eco-sales[.]ruSuspicious65Verified 2026-08-01cs-coin[.]linkHigh76Verified 2026-08-01b4mcx2ml[.]netSuspicious64Verified 2026-08-01avmn99[.]comSuspicious63Verified 2026-08-01filemix-1[.]comSuspicious68Verified 2026-08-01animesuge[.]ioSuspicious69Verified 2026-08-0188078391ee27f0053dd2e069b7d19b42[.]comSuspicious70Verified 2026-08-01aj0453[.]topSuspicious60Verified 2026-08-01el663rr366le[.]comSuspicious70Verified 2026-08-01diakimnea[.]comSuspicious64Verified 2026-08-014bike[.]netSuspicious67Verified 2026-08-01capp[.]comSuspicious62Verified 2026-08-01elpyp44pyple[.]comSuspicious71Verified 2026-08-01freefoodaid[.]comSuspicious68Verified 2026-08-01atomload[.]toSuspicious72Verified 2026-08-01frajda[.]xyzSuspicious62Verified 2026-08-01filmmogzivota[.]rsSuspicious60Verified 2026-08-01dropproposalcloud[.]comSuspicious61Verified 2026-08-01
Start free, in five minutes
1,000 verdicts/month on the free tier, LLM layer included. No card required.