What it detects01
What does 'ASN Domain Low Popularity' indicate?
It indicates that domains hosted under this ASN show very low visibility or traffic, a characteristic commonly seen in disposable or short-lived malicious infrastructures.
ASN Domain Low Popularity
It indicates that domains hosted under this ASN show very low visibility or traffic, a characteristic commonly seen in disposable or short-lived malicious infrastructures.
Analyst Q&A
What this signal answers
Three questions every analyst asks before acting on this signal.
Why it matters02
Why is low domain popularity relevant for ASN-level risk assessment?
Malicious domains often lack organic traffic, backlinks or long-term user engagement. When an ASN consistently hosts such low-popularity domains, it suggests the environment may support short-term or abuse-oriented operations.
How analysts use it03
How should analysts interpret this signal?
This is a weak-to-moderate malicious indicator. On its own it does not prove abusive activity, but it becomes meaningful when combined with other risky signals such as newly registered domains, blacklist activity or unstable hosting patterns.
Often paired with:alert_only
Evidence shape
What ASN Domain Low Popularity looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "asn_domain_low_popularity",
"name": "ASN Domain Low Popularity",
"group": "dns_history",
"subgroup": "asn_infrastructure_profile",
"direction": "malicious",
"evidence": {
"asn": "AS13335",
"asn_org": "Cloudflare, Inc.",
"asn_allocation_year": 2010,
"asn_geo_risk": "low",
"hosted_domain_count": 18420315
}
}Siblings
Peers in ASN Infrastructure Profile
13 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
ASN Domain Flagged By Security Vendors
It indicates that one or more domains under this ASN have been reported as malicious by commercial or open-source securi…
MaliciousCore
Malicious Infrastructure Observed in ASN
It indicates that domains hosted under this ASN have been involved in malware distribution, payload hosting, or command-…
MaliciousCore
ASN Domain Algorithmic Naming Pattern
It indicates that domains hosted under this ASN exhibit algorithmic or pseudo-random naming characteristics, a pattern s…
Malicious
ASN Domain Newly Registered
It means that one or more domains hosted under this ASN were registered very recently, which is a common trait of early-…
Malicious
In the wild
See ASN Domain Low Popularity fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Open Verdict Gallery
Pre-filtered to ASN Domain Low Popularity. See real IOCs this signal caught and the verdicts the engine returned.
Start free, in five minutes
100 IOCs/day on the free tier, LLM layer included. No card required.