It indicates that the domain uses a paid or premium email service provider. This is typically associated with legitimate organizations that invest in reliable and secure email infrastructure.
The questions every analyst asks before acting on this signal.
It indicates that the domain uses a paid or premium email service provider. This is typically associated with legitimate organizations that invest in reliable and secure email infrastructure.
Domains using paid email services are less likely to be involved in malicious activity since reputable providers enforce identity verification, anti-spam policies, and abuse monitoring.
It shows that the domain has consistently used a paid email provider for an extended period, reinforcing its reputation stability and operational continuity.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "paid_mail_service",
"name": "Paid Mail Service Detected",
"group": "dns_history",
"subgroup": "dns_records_mx_ns",
"direction": "safe",
"evidence": {
"ns_provider": "cloudflare.com",
"ns_provider_tier": "paid_public",
"ns_stability_days": 412,
"mx_provider": "google.com",
"mx_provider_tier": "paid_mail"
}
}12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the domain relies on free or temporary mail providers. Such behavior is common among malicious or low-…
It indicates that the domain is backed by a paid, reputable DNS provider rather than free or disposable nameservers. Thi…
It indicates that both IP and NS (nameserver) records of a domain are changing frequently, a behavior known as 'Double-F…
It means the domain operates its own mail exchange (MX) servers instead of relying on trusted third-party providers like…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
donormix[.]comSuspicious64Verified 2026-08-01dropsbrindes[.]com[.]brSuspicious66Verified 2026-08-01albatros[.]uzSuspicious63Verified 2026-08-01cdn77[.]vipSuspicious69Verified 2026-08-01alexscan[.]netSuspicious65Verified 2026-08-01deltainternet[.]net[.]brSuspicious62Verified 2026-08-01dropproposalcloud[.]comSuspicious61Verified 2026-08-01atomlines[.]comSuspicious64Verified 2026-08-01eboz[.]comSuspicious60Verified 2026-08-01clientshostname[.]comSuspicious61Verified 2026-08-01d-n-s[.]nameSuspicious64Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.