Skip to content

Known Organization IP Block

The domain's IP belongs to a registered ISP or organization block listed in threat intelligence feeds under the 'organizations' category.

See verdicts firing this signalOpen in API reference
Analyst Q&A

What this signal answers

The questions every analyst asks before acting on this signal.

What it detects01

What does 'Known Organization IP Block' mean?

The domain's IP belongs to a registered ISP or organization block listed in threat intelligence feeds under the 'organizations' category.

Why it matters02

Why is this a safe signal?

Organization IP blocks represent dedicated, registered allocations to known entities with accountability and abuse handling procedures.

How analysts use it03

How should analysts interpret this signal?

Treat it as a supporting safe indicator, the IP infrastructure belongs to a known, accountable organization.

Evidence shape

What Known Organization IP Block looks like in the response

A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.

json
{
  "slug": "ip_known_organization_block",
  "name": "Known Organization IP Block",
  "group": "threat_intelligence_feed",
  "subgroup": "ip_blacklist_reputation",
  "direction": "safe",
  "evidence": {
    "blacklist_count": 7,
    "listing_sources": [
      "spamhaus",
      "abuseipdb",
      "uribl"
    ],
    "first_listed_days_ago": 3,
    "last_listed_days_ago": 0
  }
}
See in API reference
Siblings

Peers in IP Blacklist & Reputation

6 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.

Unroutable IP Block Detected

The domain's IP belongs to an address range flagged as unroutable in global routing tables, bogon or reserved IP ranges.

Malicious
Fast Emerging Blacklist IP

It indicates that the IP was listed on blacklist feeds very shortly after the IP block or infrastructure was registered …

MaliciousCore
High-Risk Blacklist Sources

It means the IP address appears in at least one threat intelligence blacklist, indicating it has been associated with su…

MaliciousCore
Anonymizer/VPN/Proxy IP Detected

The domain's IP is associated with anonymization services such as VPN providers, Tor exit nodes, or proxy networks.

Malicious
Show 2 more in IP Blacklist & Reputation
In the wild

See Known Organization IP Block fire on real IOCs

The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.

Open Verdict Gallery
Pre-filtered to Known Organization IP Block. See real IOCs this signal caught and the verdicts the engine returned.
Verdicts ✓

Latest reports carrying this signal

Start free, in five minutes

1,000 verdicts/month on the free tier, LLM layer included. No card required.

Get an API keyBack to IP Blacklist & Reputation