`cbx-rtb[.]com`

Recommended actionalert_onlyIOC typedomainVerified2026-08-01

Risk level

Suspicious

score 60 / 100

Why this verdict

Evidence and analysis

VerdictIQ AIGenerated from 33 deterministic signals

cbx-rtb[.]com is classified as suspicious with a risk score of 60/100: ambiguous posture; signals suggest concern but lack convergent evidence. The recommended downstream action is alert_only.

The risk model observed 33 signals (including 10 core signals) across 5 taxonomy groups (Popularity & Backlink, DNS History, HTTP Crawling, and others). The strongest indicators are Critical SSL CA Issue, Flagged by Security Vendors, Listed in Malware Sources, plus 30 additional supporting signals. Each signal carries its own trigger evidence and direction; signal fusion drives the calibrated tier assignment.

Recommended response. Surface to analyst review or SIEM correlation. Evidence is strong enough to warrant attention but not strong enough to block without context. For active investigation, run POST /verdict with the indicator to confirm the verdict against the current state of the domain. VerdictIQ's scoring recomputes today's signals on every call.

Signal evidence

Top 10 of 33Showing all 33

Critical SSL CA IssuecoreHTTP CrawlingIt means that the SSL/TLS certificate presented by the domain failed critical validation checks.
Flagged by Security VendorscoreThreat IntelligenceIt means that one or more commercial security vendors, including antivirus engines, sandboxes, or threat intelligence providers, have classified or reported the domain as malicious.
Listed in Malware SourcescoreThreat IntelligenceIt means that the domain has appeared in public or open-source malware intelligence feeds.
Low-Control General Hosting NetworkcoreDNS HistoryIt indicates that the ASN belongs to hosting environments statistically associated with higher abuse rates, weak onboarding controls, or historically malicious operations.
DGA-Generated LabelcoreThreat IntelligenceIt indicates that the domain name exhibits statistical patterns typical of algorithmically generated domains (DGA).
Limited Web Structure DetectedHTTP CrawlingIt means the domain hosts only a few subpages or internal links.
Newly-Activated DomainDNS HistoryIt indicates that the domain has recently become active and started responding to DNS queries after a period of inactivity or recent registration.
WHOIS Record Updated in Last WeekWHOISIt indicates that the domain's WHOIS data, such as ownership, registrar, or contact details, has been updated within a recent time frame.
One-Off Popularity RisePopularity & BacklinkIt indicates that the domain's PageRank time series contains a single interior point where the rank improved (numerically decreased) by more than the extreme_spike_ratio (default 100x) compared to…
Non-Public DomainHTTP CrawlingIt refers to a domain that operates with restricted accessibility, its HTTP/HTTPS services are either protected, limited to specific users, or intentionally unreachable from the public internet.
Weak Popularity DomainPopularity & BacklinkIt represents a domain with limited but detectable user traffic or DNS activity.
Small IP Block AllocationDNS HistoryIt indicates that the IP block allocated to the ASN is unusually small.
Newly-Issued SSL CertificateHTTP CrawlingIt indicates that the SSL certificate associated with the domain has been newly created or issued.
Geo-Registry Country MismatchDNS HistoryThe IP's geolocation doesn't match the RIR allocation country.
Geolocation Mismatch or High-Risk RegionDNS HistoryIt indicates that the ASN shows geolocation anomalies, such as a mismatch between registry country and observed country or continent, or that it is associated with a country known for elevated abuse…
Global Popularity ScorecorePopularity & BacklinkIt refers to globally recognized, high-traffic domains with verified ownership and a long operational history, such as google.com or microsoft.com.
Large-Scale Enterprise IP BlockcoreDNS HistoryIt indicates that the IP address belongs to a large-scale, long-established, and officially allocated enterprise network.
SSL DV ValidationcoreHTTP CrawlingIt indicates that the SSL/TLS certificate’s Common Name (CN) or Subject Alternative Name (SAN) correctly matches the accessed hostname.
Long-Registered DomaincoreWHOISIt indicates that the domain’s WHOIS record shows a long registration duration, typically 2, 5, or 10+ years.
Long-Running IPcoreDNS HistoryThese refer to domains that have consistently resolved through DNS over a long period.
Major Cloud or CDN InfrastructureDNS HistoryIt indicates that the ASN belongs to a clearly identified regulated network category such as major cloud/CDN providers, government infrastructure, or academic and research networks.
Stable NS Usage Long TermDNS HistoryIt shows that the domain has maintained the same nameserver configuration without fluctuations, suggesting predictable and well-managed DNS infrastructure.
Centralized IP-Subdomain Infrastructure DetectedDNS HistoryIt indicates that multiple subdomains of the same domain are actively served through a shared IP address over a long period.
Registry–Geo CIDR Full MatchDNS HistoryIt indicates that the delegated registry CIDR fully matches the geolocation CIDR, meaning the entire IP block consistently maps to a single country or region with no fragmentation.
Paid Public NS Usage Premium ProviderDNS HistoryIt indicates that the domain is backed by a paid, reputable DNS provider rather than free or disposable nameservers.
Newly Niche-AuthoritativePopularity & BacklinkA domain that is referenced by a small number of sources (mid or tail harmonic centrality) but those sources carry strong authority (PageRank head).
Observed and Registered Geolocation ConsistencyDNS HistoryIt indicates that the observed geolocation of the IP matches its registered geolocation, suggesting a stable and expected geographic placement for the infrastructure at the time of observation.
ASN Allocated Long Time AgoDNS HistoryIt means that the ASN was allocated many years ago and has a long operational history.
Strict-Policy RIR RegionDNS HistoryIt indicates that the ASN is allocated by a regional internet registry known for strict allocation controls and strong abuse-handling processes, providing supportive safe context for the…
Private Certificate Authority (CA) Signed SSL DetectedHTTP CrawlingIt means that the SSL/TLS certificate in use was issued by a private or internal Certificate Authority rather than a globally recognized CA.
Single DC Hub FootprintDNS HistoryIt indicates that the IP address belongs to data center or hosting infrastructure and describes the current geographic footprint of that infrastructure based on observed IP locations.
Gradual Popularity Growth DomainPopularity & BacklinkIt reflects a consistent and organic increase in user visits, backlinks, and visibility over time.
Long-Term SSL Certificate ValidityHTTP CrawlingIt means that the SSL/TLS certificate of the domain has been issued with an unusually long validity period (e.g., multiple years).

Read the full scoring methodology at /product/ioc-verdict or the canonical signal taxonomy at /signal-library.

Similar verdicts

Domains sharing signals with cbx-rtb[.]com. Pattern similarity often indicates campaign reuse or shared infrastructure.

DomainVerdictScoreLast verifiedTop signal

eboz[.]comSuspicious602026-08-01Long-lived HTTP Service Detected f3322[.]orgSuspicious662026-08-01Centralized IP-Subdomain Infrastructure Detected albatros[.]uzSuspicious632026-08-01Geo-Registry Country Mismatch anondns[.]netSuspicious632026-08-01Newly-Issued SSL Certificate grandkadrihotel[.]comSuspicious602026-08-01Single DC Hub Footprint

Query any domain, not just this one

POST /verdict returns the same signals, score and recommended action for any indicator you send, computed against today's data.

Run POST /verdict Browse the verdict gallery

Part of a curated wave, re-verified periodically; reports older than 90 days are de-indexed until re-verified. Dispute a verdict at reports@verdictiq.io, response within 5 business days. Trust & compliance →