It indicates that the domain has maintained the same IP address or hosting infrastructure for an extended period—weeks, months, or even years. This reflects high IP retention and stability, characteristics often seen in legitimate and well-managed services.
Three questions every analyst asks before acting on this signal.
It indicates that the domain has maintained the same IP address or hosting infrastructure for an extended period—weeks, months, or even years. This reflects high IP retention and stability, characteristics often seen in legitimate and well-managed services.
Long-term use of the same IP suggests operational consistency, infrastructure investment, and low likelihood of evasion tactics. Legitimate organizations rarely change their IPs frequently because doing so can disrupt services, SEO, and trust mechanisms.
It’s uncommon but possible—especially for advanced persistent threats (APTs) using dedicated infrastructure. However, most malicious domains prefer transient or disposable hosting to avoid detection. Therefore, long IP lifespan generally supports domain safety.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "long_ip_retention",
"name": "Long IP Lifespan",
"group": "dns_history",
"subgroup": "ip_stability_retention",
"direction": "safe",
"evidence": {
"current_ip_lifespan_days": 612,
"median_ip_lifespan_days": 540,
"ip_churn_30d": 1,
"last_ip_change_days_ago": 612
}
}7 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the domain remains associated with an IP address for only a short duration—typically a few hours or da…
These refer to domains that have consistently resolved through DNS over a long period. Long-lived DNS activity often ind…
It means the domain operates on an IP address that is not shared with any other unrelated domains. This indicates a dedi…
It refers to domains that have not been active or resolvable through DNS for an extended period. Dead domains often indi…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.