Skip to content

DNS History

Seven angles on a domain's DNS footprint: NS/MX provider quality, activation and hijack lifecycle, IP stability and rotation diversity, geolocation consistency, ASN reputation neighborhood, and registry allocation history. Each signal fires with the concrete artifact behind it (NS provider, activation date, IP lifespan, country pair, ASN id, CIDR), recomputed live per IOC instead of pulled from a static feed.

See 55 DNS History signalsSee verdicts firing these
  • 55 named signals across 7 subgroups
  • Recomputed live per IOC, not pulled from a static feed
  • Every signal ships with evidence + 3-question Q&A trail
About

What DNS History models

Models a domain's DNS footprint over time: NS/MX posture, activation lifecycle, IP stability, geo and registry allocation.

What it models
Models a domain's DNS footprint over time: NS/MX posture, activation lifecycle, IP stability, geo and registry allocation.
How it fires
Each signal fires with the concrete artifact behind it (NS provider, activation date, IP lifespan, country pair, ASN id, CIDR), recomputed live per IOC.
Why it matters
Catches newly-activated, hijacked, and fast-flux infrastructure before vendor feeds aggregate them; the first verdict layer for any FQDN.
Subgroups

7 subgroups · 55 signals in DNS History

Each subgroup bundles signals that share a mechanism: same evidence shape, same direction logic. Tap one to inspect its signal names; every name opens a leaf page with the underlying Q&A trail.

See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail
Verdict scenarios

How DNS History shapes the call

Three real-world situations where this group's evidence dominates the decision. The verdict and explanation are how VerdictIQ would frame the outcome to an analyst, not raw signal slugs.

High riskVERDICT · BLOCK
The situation

A domain registered last week, mail handled by a disposable mail provider, resolving to a hosting block where multiple sibling domains were flagged in the past 30 days.

VerdictIQ explains

“Decline this domain. The DNS footprint reads as a fresh phishing spin-up: short ownership history, throwaway mail infrastructure, and a hosting neighborhood with active abuse. Hold the verdict for at least 30 days before re-checking.”

Medium riskVERDICT · REVIEW
The situation

A domain that has been active for two months, but its IP set rotates daily across small allocations in three different countries.

VerdictIQ explains

“Send to analyst review. The age signals stability, but the IP rotation pattern and small-block geographic spread are common in fast-flux operations. Pull the asset's resolution history before letting traffic through.”

Low riskVERDICT · ALLOW
The situation

A long-lived domain with stable NS/MX records hosted on a premium DNS provider, long IP retention, and a single-region geolocation footprint.

VerdictIQ explains

“Allow. The DNS shape matches a legitimate, well-operated property: paid infrastructure, multi-year retention, and a coherent geographic profile. No active reasons to delay the request.”

See full Verdict Gallery

See DNS History signals fire on your data

Free tier: 100 IOCs/day, LLM layer included.

Start FreeOpen API reference