Every verdict, traced to a named signal.
Browse the behavioral signal catalog VerdictIQ fires when scoring an indicator. Each entry carries a slug, a display name, a stable evidence shape and an analyst Q&A; no hidden heuristics, no black-box scores.
- 211 domain signals · 6 groups · 26 subgroups · live today.
- IP, IP Block, ASN, File Hash: on the roadmap, early-access open.
- Same shape across every IOC type, same evidence keys.
- DNS History2 firedrisk-raising signal:Newly-Activated Domainrisk-lowering signal:Paid Public NS Usage Premium Provider
- HTTP Crawling History1 firedrisk-raising signal:Short-Term SSL Certificate Validity
- Popularity & Backlink0 fired
- Relational Intelligence1 firedrisk-raising signal:Active Association with Malicious DomainCore
- Threat Intelligence Feed1 firedrisk-raising signal:Listed in Malware Feeds (Domain-Level)Core
- WHOIS1 firedrisk-raising signal:Registered in Last Week
Representative product screen
Pick the indicator you want to query.
Each IOC type carries its own behavioral signal set. Start with what we already ship; join the early-access list for the rest.
Lifecycle, DNS, hosting, popularity, WHOIS and threat-intel context for any FQDN.
Reputation, hosting churn, port behavior and RBL co-listing signals for any IPv4/IPv6 address.
CIDR-level density, allocation history and co-tenancy signals for IP ranges.
Autonomous System posture: peering hygiene, abuse history and customer-cone characteristics.
File reputation, sandbox behavior, signing posture and prevalence for MD5 / SHA-1 / SHA-256.
Start with a free API key.
Query a domain, see signals fire on your own IOC. IP / ASN / file-hash signals ship on the roadmap above.