What it detects01
What does 'ASN Domain Newly Registered' indicate?
It means that one or more domains hosted under this ASN were registered very recently, which is a common trait of early-stage malicious infrastructure.
ASN Domain Newly Registered
It means that one or more domains hosted under this ASN were registered very recently, which is a common trait of early-stage malicious infrastructure.
Analyst Q&A
What this signal answers
Three questions every analyst asks before acting on this signal.
Why it matters02
Why are newly registered domains considered risky in ASN-level analysis?
Threat actors often deploy freshly registered domains for phishing, malware delivery or command-and-control activities. When an ASN repeatedly hosts newly registered domains, it signals potentially abusive behavior patterns.
How analysts use it03
How should analysts interpret this indicator?
It is a supporting malicious signal. While not conclusive on its own, the presence of newly registered domains under an ASN increases suspicion when combined with other indicators such as blacklist activity, churn or suspicious hosting characteristics.
Often paired with:alert_only
Evidence shape
What ASN Domain Newly Registered looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "asn_domain_newly_registered",
"name": "ASN Domain Newly Registered",
"group": "dns_history",
"subgroup": "asn_infrastructure_profile",
"direction": "malicious",
"evidence": {
"asn": "AS13335",
"asn_org": "Cloudflare, Inc.",
"asn_allocation_year": 2010,
"asn_geo_risk": "low",
"hosted_domain_count": 18420315
}
}Siblings
Peers in ASN Infrastructure Profile
13 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
ASN Domain Short Uptime
It indicates that domains hosted under this ASN have only been reachable for a very short period of time before being ob…
Malicious
ASN Domain Flagged By Security Vendors
It indicates that one or more domains under this ASN have been reported as malicious by commercial or open-source securi…
MaliciousCore
Malicious Infrastructure Observed in ASN
It indicates that domains hosted under this ASN have been involved in malware distribution, payload hosting, or command-…
MaliciousCore
ASN Domain Algorithmic Naming Pattern
It indicates that domains hosted under this ASN exhibit algorithmic or pseudo-random naming characteristics, a pattern s…
Malicious
In the wild
See ASN Domain Newly Registered fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Open Verdict Gallery
Pre-filtered to ASN Domain Newly Registered. See real IOCs this signal caught and the verdicts the engine returned.
Start free, in five minutes
100 IOCs/day on the free tier, LLM layer included. No card required.