Skip to content

CDN Infrastructure Detected

The domain is hosted on shared infrastructure such as a CDN, cloud provider, or shared hosting platform.

See verdicts firing this signalOpen in API reference
Also surfaces as:
Cloud Infrastructure DetectedShared Hosting Infrastructure DetectedLarge IP Block Infrastructure
Analyst Q&A

What this signal answers

The questions every analyst asks before acting on this signal.

What it detects01

What does 'Shared Infrastructure Profile' indicate?

The domain is hosted on shared infrastructure such as a CDN, cloud provider, or shared hosting platform.

Why it matters02

Why does this matter for scoring?

IP-based signals reflect the infrastructure provider rather than the domain itself.

How analysts use it03

How should analysts interpret the different sublabels?

CDN, Cloud, Shared hosting, or Large block, all indicate IP-level signals may not be attributable to the specific domain.

Evidence shape

What CDN Infrastructure Detected looks like in the response

A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.

json
{
  "slug": "shared_infrastructure_profile",
  "name": "CDN Infrastructure Detected",
  "group": "dns_history",
  "subgroup": "ip_stability_retention",
  "direction": "safe",
  "evidence": {
    "current_ip_lifespan_days": 612,
    "median_ip_lifespan_days": 540,
    "ip_churn_30d": 1,
    "last_ip_change_days_ago": 612
  }
}
See in API reference
Siblings

Peers in IP Stability & Retention

8 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.

Dedicated Hosting Detected

It means the domain operates on an IP address that is not shared with any other unrelated domains. This indicates a dedi…

SafeCore
Long IP Lifespan

It indicates that the domain has maintained the same IP address or hosting infrastructure for an extended period, weeks,…

SafeCore
Long-Lived Active Domain

These refer to domains that have consistently resolved through DNS over a long period. Long-lived DNS activity often ind…

SafeCore
Dead Domain

It refers to domains that have not been active or resolvable through DNS for an extended period. Dead domains often indi…

Malicious
Show 4 more in IP Stability & Retention
In the wild

See CDN Infrastructure Detected fire on real IOCs

The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.

Open Verdict Gallery
Pre-filtered to CDN Infrastructure Detected. See real IOCs this signal caught and the verdicts the engine returned.
Verdicts ✓

Latest reports carrying this signal

Start free, in five minutes

1,000 verdicts/month on the free tier, LLM layer included. No card required.

Get an API keyBack to IP Stability & Retention