Skip to content
NewVerdictIQ Connector is here. One Docker image enriches your DNS logs with verdicts inside your network and forwards them to your SIEM.Install guide
High79/100actionblock_domain
VerdictIQSecurity Report

Subject

avnserversg[.]international

Recommended actionblock_domainIOC typedomainVerified2026-08-01

Risk level

High

score 79 / 100

VerdictIQ scores avnserversg[.]international as High (risk 79/100), driven by Critical SSL CA Issue; recommended action: block. Source: VerdictIQ, 2026-08-01.

Why this verdict

Evidence and analysis

VerdictIQ AIGenerated from 8 deterministic signals

avnserversg[.]international is classified as high with a risk score of 79/100: elevated-risk posture; converging signals indicate intent. The recommended downstream action is block_domain.

The risk model observed 8 signals (including 4 core signals) across 2 taxonomy groups (HTTP Crawling, Threat Intelligence). The strongest indicators are Critical SSL CA Issue, Listed in Google Safe Browsing, Flagged by Security Vendors, plus 5 additional supporting signals. Each signal carries its own trigger evidence and direction; signal fusion drives the calibrated tier assignment.

Recommended response. Block at the perimeter (DNS firewall, SWG, EDR network rules). The signal stack supports a deny-by-default posture; blocking is unlikely to disrupt legitimate traffic. For active investigation, run POST /verdict with the indicator to confirm the verdict against the current state of the domain. VerdictIQ's scoring recomputes today's signals on every call.

VerdictIQ AI re-states deterministic signal evidence as natural language. The verdict itself comes from the calibrated risk model, not the AI layer. Re-runs are stable and explainable.

Signal evidence

Showing all 8Showing all 8
  • Critical SSL CA IssuecoreHTTP CrawlingIt means that the SSL/TLS certificate presented by the domain failed critical validation checks.
  • Listed in Google Safe BrowsingcoreThreat IntelligenceGoogle Safe Browsing (GSB) is Google's flagship anti-abuse blocklist used by Chrome, Firefox, Safari and Android.
  • Flagged by Security VendorscoreThreat IntelligenceIt means that one or more commercial security vendors, including antivirus engines, sandboxes, or threat intelligence providers, have classified or reported the domain as malicious.
  • Default Web Page DetectedHTTP CrawlingIt refers to a website that displays the default or placeholder page of a known web technology, such as 'Apache Default Page' or 'Nginx Welcome Page'.
  • Short-Term SSL Certificate ValidityHTTP CrawlingIt means the SSL/TLS certificate of the domain has an unusually short validity period, often lasting only days or weeks.
  • Free-Issued SSL CertificateHTTP CrawlingIt indicates that the domain uses an SSL certificate issued by a free or automated Certificate Authority, such as Let's Encrypt.
  • SSL DV ValidationcoreHTTP CrawlingIt indicates that the SSL/TLS certificate’s Common Name (CN) or Subject Alternative Name (SAN) correctly matches the accessed hostname.
  • Not Listed in Open-Source Threat FeedsThreat IntelligenceIt indicates that the domain does not appear in any public or open-source threat intelligence feeds, malware repositories, or IOC databases.

Read the full scoring methodology at /product/ioc-verdict or the canonical signal taxonomy at /signal-library.

More like this

Similar verdicts

Domains sharing signals with avnserversg[.]international. Pattern similarity often indicates campaign reuse or shared infrastructure.

Query any domain, not just this one

POST /verdict returns the same signals, score and recommended action for any indicator you send, computed against today's data.

Part of a curated wave, re-verified periodically; reports older than 90 days are marked stale until re-verified. Dispute a verdict at reports@verdictiq.io, response within 5 business days. Trust & compliance →