It indicates that the domain remains associated with an IP address for only a short duration—typically a few hours or days—before either becoming inactive or switching to a new IP. This pattern reflects low IP retention and is often seen in temporary or evasive infrastructures.
Three questions every analyst asks before acting on this signal.
It indicates that the domain remains associated with an IP address for only a short duration—typically a few hours or days—before either becoming inactive or switching to a new IP. This pattern reflects low IP retention and is often seen in temporary or evasive infrastructures.
Threat actors frequently use short-lived or disposable hosting to support phishing, malware delivery, or command-and-control operations. By keeping IP associations brief, they minimize detection, reputation scoring, and blocking effectiveness.
Occasionally, yes—especially during hosting migrations, DNS propagation, or testing phases. However, legitimate domains typically maintain operational uptime and use consistent IP ranges, while malicious ones show repetitive short activation cycles followed by downtime.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "short_ip_retention",
"name": "Short IP Lifespan",
"group": "dns_history",
"subgroup": "ip_stability_retention",
"direction": "malicious",
"evidence": {
"current_ip_lifespan_days": 612,
"median_ip_lifespan_days": 540,
"ip_churn_30d": 1,
"last_ip_change_days_ago": 612
}
}7 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the domain has maintained the same IP address or hosting infrastructure for an extended period—weeks, …
These refer to domains that have consistently resolved through DNS over a long period. Long-lived DNS activity often ind…
It means the domain operates on an IP address that is not shared with any other unrelated domains. This indicates a dedi…
It refers to domains that have not been active or resolvable through DNS for an extended period. Dead domains often indi…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.