What it detects01
What does 'Newly Self-Managed MX' mean?
The domain has recently set up its own mail exchange server within a short time window.
Newly Self-Managed MX Server
The domain has recently set up its own mail exchange server within a short time window.
Analyst Q&A
What this signal answers
The questions every analyst asks before acting on this signal.
Why it matters02
Why is this distinguished from established self-managed MX?
Recently created self-managed MX is more commonly associated with newly deployed malicious infrastructure.
How analysts use it03
How should analysts investigate this signal?
Check the domain's registration date, WHOIS history, and other MX-related signals.
Often paired with:alert_only
Evidence shape
What Newly Self-Managed MX Server looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "new_self_managed_mx",
"name": "Newly Self-Managed MX Server",
"group": "dns_history",
"subgroup": "dns_records_mx_ns",
"direction": "malicious",
"evidence": {
"ns_provider": "cloudflare.com",
"ns_provider_tier": "paid_public",
"ns_stability_days": 412,
"mx_provider": "google.com",
"mx_provider_tier": "paid_mail"
}
}Siblings
Peers in DNS Records (MX/NS)
12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
Newly Self-Managed NS Server
The domain has recently configured its own nameservers within a short time window.
Malicious
Self-Managed Mail Infrastructure Detected
It means the domain operates its own mail exchange (MX) servers instead of relying on trusted third-party providers like…
SafeCore
MX Unchanged Since Domain Creation
The domain's MX records have never been changed since registration, suggesting minimal email infrastructure management.
Malicious
Self-Managed Name Server Detected
It indicates that the domain operates using its own name server infrastructure rather than a reputable third-party DNS p…
Safe
In the wild
See Newly Self-Managed MX Server fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Open Verdict Gallery
Pre-filtered to Newly Self-Managed MX Server. See real IOCs this signal caught and the verdicts the engine returned.
Latest reports carrying this signal
getyourstar[.]onlineSuspicious66Verified 2026-08-01awandata[.]ccSuspicious61Verified 2026-08-01fatherozygoted[.]comSuspicious72Verified 2026-08-01fnkaudit[.]ruSuspicious64Verified 2026-08-01agacatecrest[.]comSuspicious62Verified 2026-08-01equipaderm[.]com[.]brSuspicious69Verified 2026-08-01dp-renovar[.]comSuspicious71Verified 2026-08-01fidelityschedule[.]comSuspicious70Verified 2026-08-01fuckgaypornvideos[.]clickSuspicious65Verified 2026-08-01ahm-jp[.]proSuspicious63Verified 2026-08-01biaommo-es[.]comSuspicious67Verified 2026-08-0178ff338c8bc9cec4db77a5b04b3713bf[.]topHigh77Verified 2026-08-01
Start free, in five minutes
1,000 verdicts/month on the free tier, LLM layer included. No card required.