Skip to content
Suspicious60/100actionalert_only
VerdictIQSecurity Report

Subject

22238[.]net

Recommended actionalert_onlyIOC typedomainVerified2026-08-01

Risk level

Suspicious

score 60 / 100

Why this verdict

Evidence and analysis

VerdictIQ AIGenerated from 25 deterministic signals

22238[.]net is classified as suspicious with a risk score of 60/100: ambiguous posture; signals suggest concern but lack convergent evidence. The recommended downstream action is alert_only.

The risk model observed 25 signals (including 5 core signals) across 5 taxonomy groups (DNS History, HTTP Crawling, WHOIS, and others). The strongest indicators are Critical SSL CA Issue, Listed in Malware Sources, Flagged by Security Vendors, plus 22 additional supporting signals. Each signal carries its own trigger evidence and direction; signal fusion drives the calibrated tier assignment.

Recommended response. Surface to analyst review or SIEM correlation. Evidence is strong enough to warrant attention but not strong enough to block without context. For active investigation, run POST /verdict with the indicator to confirm the verdict against the current state of the domain. VerdictIQ's scoring recomputes today's signals on every call.

VerdictIQ AI re-states deterministic signal evidence as natural language. The verdict itself comes from the calibrated risk model, not the AI layer. Re-runs are stable and explainable.

Signal evidence

Top 10 of 25Showing all 25
  • Critical SSL CA IssuecoreHTTP CrawlingIt means that the SSL/TLS certificate presented by the domain failed critical validation checks.
  • Listed in Malware SourcescoreThreat IntelligenceIt means that the domain has appeared in public or open-source malware intelligence feeds.
  • Flagged by Security VendorscoreThreat IntelligenceIt means that one or more commercial security vendors, including antivirus engines, sandboxes, or threat intelligence providers, have classified or reported the domain as malicious.
  • Geo-Registered Country MismatchDNS HistoryThe IP's geolocation country doesn't match the domain's WHOIS registered country.
  • Short-Term SSL Certificate ValidityHTTP CrawlingIt means the SSL/TLS certificate of the domain has an unusually short validity period, often lasting only days or weeks.
  • Geo-Registry Country MismatchDNS HistoryThe IP's geolocation doesn't match the RIR allocation country.
  • WHOIS Record Updated in Last WeekWHOISIt indicates that the domain's WHOIS data, such as ownership, registrar, or contact details, has been updated within a recent time frame.
  • Non-Public DomainHTTP CrawlingIt refers to a domain that operates with restricted accessibility, its HTTP/HTTPS services are either protected, limited to specific users, or intentionally unreachable from the public internet.
  • Current and Historical Geolocation DivergenceDNS HistoryIt indicates that the geolocation of the domain’s currently active IP addresses significantly differs from the geolocations observed in its historical IP usage, suggesting a notable shift in…
  • Newly-Issued SSL CertificateHTTP CrawlingIt indicates that the SSL certificate associated with the domain has been newly created or issued.
  • Weak Popularity DomainPopularity & BacklinkIt represents a domain with limited but detectable user traffic or DNS activity.
  • Recently Isolated DomainPopularity & BacklinkA domain whose harmonic centrality places it in the deep tail (very few distinct sources link to it) while PageRank is also in the mid-to-tail range.
  • Small IP Block AllocationDNS HistoryIt indicates that the IP block allocated to the ASN is unusually small.
  • Limited Web Structure DetectedHTTP CrawlingIt means the domain hosts only a few subpages or internal links.
  • Long-Running IPcoreDNS HistoryThese refer to domains that have consistently resolved through DNS over a long period.
  • SSL DV ValidationcoreHTTP CrawlingIt indicates that the SSL/TLS certificate’s Common Name (CN) or Subject Alternative Name (SAN) correctly matches the accessed hostname.
  • Registry–Geo CIDR Full MatchDNS HistoryIt indicates that the delegated registry CIDR fully matches the geolocation CIDR, meaning the entire IP block consistently maps to a single country or region with no fragmentation.
  • ASN Allocated Long Time AgoDNS HistoryIt means that the ASN was allocated many years ago and has a long operational history.
  • Paid Public NS Usage Premium ProviderDNS HistoryIt indicates that the domain is backed by a paid, reputable DNS provider rather than free or disposable nameservers.
  • Web Technology Stack DetectedHTTP CrawlingIt means that the domain uses one or more identifiable web technologies, such as CMS platforms (WordPress, Drupal), JavaScript frameworks (React, Angular, Vue), analytics tools, CDNs, or web servers.
  • Private Certificate Authority (CA) Signed SSL DetectedHTTP CrawlingIt means that the SSL/TLS certificate in use was issued by a private or internal Certificate Authority rather than a globally recognized CA.
  • Stable NS Usage Long TermDNS HistoryIt shows that the domain has maintained the same nameserver configuration without fluctuations, suggesting predictable and well-managed DNS infrastructure.
  • Content-Rich HomepageHTTP CrawlingIt means that the domain’s homepage contains a sufficient amount of structured, relevant, and well-presented web content.
  • Strict-Policy RIR RegionDNS HistoryIt indicates that the ASN is allocated by a regional internet registry known for strict allocation controls and strong abuse-handling processes, providing supportive safe context for the…
  • Country-Level IP Geolocation CentralizationDNS HistoryIt indicates that all currently active IP addresses of a domain are geographically concentrated in a single location scope, typically within one country.

Read the full scoring methodology at /product/ioc-verdict or the canonical signal taxonomy at /signal-library.

More like this

Similar verdicts

Domains sharing signals with 22238[.]net. Pattern similarity often indicates campaign reuse or shared infrastructure.

DomainVerdictScoreLast verifiedTop signal
filmmogzivota[.]rsSuspicious602026-08-01Stable MX Usage Long Termgoldenbook[.]aeSuspicious602026-08-01Limited Web Structure Detectedatomlines[.]comSuspicious642026-08-01Flagged by Security Vendorsdropsbrindes[.]com[.]brSuspicious662026-08-01Strict-Policy RIR Regionamunfezanttor[.]comSuspicious622026-08-01Geolocation Mismatch or High-Risk Region

Query any domain, not just this one

POST /verdict returns the same signals, score and recommended action for any indicator you send, computed against today's data.

Run POST /verdictBrowse the verdict gallery

Part of a curated wave, re-verified periodically; reports older than 90 days are de-indexed until re-verified. Dispute a verdict at reports@verdictiq.io, response within 5 business days. Trust & compliance →