What it detects01
What does 'DNS A Record Resolves to Private IP' indicate?
It indicates that a public domain resolves via a DNS A record to a non-routable private or non-public IP address, such as RFC1918, loopback, link-local, or reserved ranges.
DNS A Record Resolves to Private IP
It indicates that a public domain resolves via a DNS A record to a non-routable private or non-public IP address, such as RFC1918, loopback, link-local, or reserved ranges.
Analyst Q&A
What this signal answers
Three questions every analyst asks before acting on this signal.
Why it matters02
Why is this considered a malicious-leaning signal?
Public domains resolving to private IP addresses are abnormal in standard internet usage and are commonly associated with DNS rebinding techniques, internal network targeting, or intentional infrastructure misuse.
How analysts use it03
How should SOC analysts interpret this label?
This label should be treated as a medium-strength malicious-leaning signal and evaluated together with behavioral indicators such as rebinding patterns, recent DNS changes, or anomalous web and application activity.
Often paired with:alert_only
Evidence shape
What DNS A Record Resolves to Private IP looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "dns_a_private_ip",
"name": "DNS A Record Resolves to Private IP",
"group": "dns_history",
"subgroup": "ip_stability_retention",
"direction": "malicious",
"evidence": {
"current_ip_lifespan_days": 612,
"median_ip_lifespan_days": 540,
"ip_churn_30d": 1,
"last_ip_change_days_ago": 612
}
}Siblings
Peers in IP Stability & Retention
7 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
Dedicated Hosting Detected
It means the domain operates on an IP address that is not shared with any other unrelated domains. This indicates a dedi…
SafeCore
Long IP Lifespan
It indicates that the domain has maintained the same IP address or hosting infrastructure for an extended period—weeks, …
SafeCore
Long-Lived Active Domain
These refer to domains that have consistently resolved through DNS over a long period. Long-lived DNS activity often ind…
SafeCore
Dead Domain
It refers to domains that have not been active or resolvable through DNS for an extended period. Dead domains often indi…
Malicious
In the wild
See DNS A Record Resolves to Private IP fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Open Verdict Gallery
Pre-filtered to DNS A Record Resolves to Private IP. See real IOCs this signal caught and the verdicts the engine returned.
Start free, in five minutes
100 IOCs/day on the free tier, LLM layer included. No card required.