Skip to content

Unroutable IP Block Detected

The domain's IP belongs to an address range flagged as unroutable in global routing tables, bogon or reserved IP ranges.

See verdicts firing this signalOpen in API reference
Analyst Q&A

What this signal answers

The questions every analyst asks before acting on this signal.

What it detects01

What does 'Unroutable IP Block' mean?

The domain's IP belongs to an address range flagged as unroutable in global routing tables, bogon or reserved IP ranges.

Why it matters02

Why is this flagged?

Unroutable IPs in DNS records can indicate misconfiguration, sinkholed infrastructure, or IP spoofing attempts.

How analysts use it03

How should analysts use this signal?

Treat it as contextual information. Investigate whether the IP is a sinkhole or indicates abandoned infrastructure.

Often paired with:alert_only
Evidence shape

What Unroutable IP Block Detected looks like in the response

A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.

json
{
  "slug": "ip_unroutable_block",
  "name": "Unroutable IP Block Detected",
  "group": "threat_intelligence_feed",
  "subgroup": "ip_blacklist_reputation",
  "direction": "malicious",
  "evidence": {
    "blacklist_count": 7,
    "listing_sources": [
      "spamhaus",
      "abuseipdb",
      "uribl"
    ],
    "first_listed_days_ago": 3,
    "last_listed_days_ago": 0
  }
}
See in API reference
Siblings

Peers in IP Blacklist & Reputation

6 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.

Known Organization IP Block

The domain's IP belongs to a registered ISP or organization block listed in threat intelligence feeds under the 'organiz…

Safe
Fast Emerging Blacklist IP

It indicates that the IP was listed on blacklist feeds very shortly after the IP block or infrastructure was registered …

MaliciousCore
High-Risk Blacklist Sources

It means the IP address appears in at least one threat intelligence blacklist, indicating it has been associated with su…

MaliciousCore
Anonymizer/VPN/Proxy IP Detected

The domain's IP is associated with anonymization services such as VPN providers, Tor exit nodes, or proxy networks.

Malicious
Show 2 more in IP Blacklist & Reputation
In the wild

See Unroutable IP Block Detected fire on real IOCs

The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.

Open Verdict Gallery
Pre-filtered to Unroutable IP Block Detected. See real IOCs this signal caught and the verdicts the engine returned.
Verdicts ✓

Start free, in five minutes

1,000 verdicts/month on the free tier, LLM layer included. No card required.

Get an API keyBack to IP Blacklist & Reputation