Skip to content

NS Unchanged Since Domain Creation

The domain's nameserver records have never been changed since registration.

See verdicts firing this signalOpen in API reference
Analyst Q&A

What this signal answers

The questions every analyst asks before acting on this signal.

What it detects01

What does 'NS Unchanged Since Creation' mean?

The domain's nameserver records have never been changed since registration.

Why it matters02

How does this differ from stable NS usage?

Stable NS (long_term) means actively maintained. NS unchanged means never touched, neglect rather than stability.

Often paired with:alert_only
Evidence shape

What NS Unchanged Since Domain Creation looks like in the response

A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.

json
{
  "slug": "ns_unchanged_since_creation",
  "name": "NS Unchanged Since Domain Creation",
  "group": "dns_history",
  "subgroup": "dns_records_mx_ns",
  "direction": "malicious",
  "evidence": {
    "ns_provider": "cloudflare.com",
    "ns_provider_tier": "paid_public",
    "ns_stability_days": 412,
    "mx_provider": "google.com",
    "mx_provider_tier": "paid_mail"
  }
}
See in API reference
Siblings

Peers in DNS Records (MX/NS)

12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.

MX Unchanged Since Domain Creation

The domain's MX records have never been changed since registration, suggesting minimal email infrastructure management.

Malicious
Newly Self-Managed NS Server

The domain has recently configured its own nameservers within a short time window.

Malicious
Paid Public NS Usage Premium Provider

It indicates that the domain is backed by a paid, reputable DNS provider rather than free or disposable nameservers. Thi…

Safe
Self-Managed Name Server Detected

It indicates that the domain operates using its own name server infrastructure rather than a reputable third-party DNS p…

Safe
Show 8 more in DNS Records (MX/NS)
In the wild

See NS Unchanged Since Domain Creation fire on real IOCs

The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.

Open Verdict Gallery
Pre-filtered to NS Unchanged Since Domain Creation. See real IOCs this signal caught and the verdicts the engine returned.
Verdicts ✓

Latest reports carrying this signal

Start free, in five minutes

1,000 verdicts/month on the free tier, LLM layer included. No card required.

Get an API keyBack to DNS Records (MX/NS)