It indicates that domains hosted under this ASN have only been reachable for a very short period of time before being observed, a pattern commonly seen in disposable or campaign-focused malicious infrastructure.
Three questions every analyst asks before acting on this signal.
It indicates that domains hosted under this ASN have only been reachable for a very short period of time before being observed, a pattern commonly seen in disposable or campaign-focused malicious infrastructure.
It means that domains within the ASN have just become active or started responding after a recent registration or a long dormant period, which is typical for early-stage phishing, malware or C2 campaigns.
These are supporting malicious indicators. While short-lived or newly activated domains alone do not prove abuse, when they are repeatedly observed under the same ASN and combined with other risk signals, they strongly suggest the ASN is used for short-term or evasive malicious operations.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "asn_domain_short_time_up_and_running",
"name": "ASN Domain Short Uptime",
"group": "dns_history",
"subgroup": "asn_infrastructure_profile",
"direction": "malicious",
"evidence": {
"asn": "AS13335",
"asn_org": "Cloudflare, Inc.",
"asn_allocation_year": 2010,
"asn_geo_risk": "low",
"hosted_domain_count": 18420315
}
}13 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It means that one or more domains hosted under this ASN were registered very recently, which is a common trait of early-…
It indicates that one or more domains under this ASN have been reported as malicious by commercial or open-source securi…
It indicates that domains hosted under this ASN have been involved in malware distribution, payload hosting, or command-…
It indicates that domains hosted under this ASN exhibit algorithmic or pseudo-random naming characteristics, a pattern s…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.