What it detects01
What does 'Paid Public NS Usage' imply?
It indicates that the domain is backed by a paid, reputable DNS provider rather than free or disposable nameservers. This often aligns with legitimate infrastructure investment.
Paid Public NS Usage Premium Provider
It indicates that the domain is backed by a paid, reputable DNS provider rather than free or disposable nameservers. This often aligns with legitimate infrastructure investment.
Also surfaces as:
Paid Public NS Usage Enterprise GradePaid Public NS Usage Long TermPaid Public NS Usage
Analyst Q&A
What this signal answers
The questions every analyst asks before acting on this signal.
Why it matters02
Why is paid NS usage considered a safe supporting indicator?
Threat actors typically avoid premium DNS services due to cost and traceability. Long-term or enterprise-grade paid NS usage reduces the likelihood of throwaway or malicious operations.
How analysts use it03
How should SOC and CTI analysts use this signal?
Use it as a confidence-boosting safe context indicator, especially when other signals are neutral or borderline. It helps push the verdict toward low-risk unless contradictory malicious evidence exists.
Evidence shape
What Paid Public NS Usage Premium Provider looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "paid_public_ns_usage",
"name": "Paid Public NS Usage Premium Provider",
"group": "dns_history",
"subgroup": "dns_records_mx_ns",
"direction": "safe",
"evidence": {
"ns_provider": "cloudflare.com",
"ns_provider_tier": "paid_public",
"ns_stability_days": 412,
"mx_provider": "google.com",
"mx_provider_tier": "paid_mail"
}
}Siblings
Peers in DNS Records (MX/NS)
12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
Newly Self-Managed NS Server
The domain has recently configured its own nameservers within a short time window.
Malicious
NS Unchanged Since Domain Creation
The domain's nameserver records have never been changed since registration.
Malicious
Paid Mail Service Detected
It indicates that the domain uses a paid or premium email service provider. This is typically associated with legitimate…
Safe
Self-Managed Name Server Detected
It indicates that the domain operates using its own name server infrastructure rather than a reputable third-party DNS p…
Safe
In the wild
See Paid Public NS Usage Premium Provider fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Open Verdict Gallery
Pre-filtered to Paid Public NS Usage Premium Provider. See real IOCs this signal caught and the verdicts the engine returned.
Latest reports carrying this signal
78gc3sfn26[.]topHigh82Verified 2026-08-01crznqa[.]asiaHigh75Verified 2026-08-01diyrecovery[.]orgSuspicious70Verified 2026-08-01bohemetulum[.]comSuspicious60Verified 2026-08-01alleviatepracticableaddicted[.]comSuspicious63Verified 2026-08-01generaitiv[.]xyzSuspicious66Verified 2026-08-01asdd[.]netSuspicious61Verified 2026-08-01crz-ibit[.]comHigh76Verified 2026-08-01agacatecrest[.]comSuspicious62Verified 2026-08-01archa[.]xyzSuspicious62Verified 2026-08-0178hvip[.]comSuspicious65Verified 2026-08-01donormix[.]comSuspicious64Verified 2026-08-01endowmentoverhangutmost[.]comSuspicious62Verified 2026-08-01fullhdizle[.]ccSuspicious61Verified 2026-08-01dragonair[.]xyzSuspicious68Verified 2026-08-01crytensbemg[.]comSuspicious69Verified 2026-08-01dp399[.]comSuspicious64Verified 2026-08-01070448[.]xyzSuspicious67Verified 2026-08-01cfckuwaiittku[.]comHigh77Verified 2026-08-01fatherozygoted[.]comSuspicious72Verified 2026-08-01
Start free, in five minutes
1,000 verdicts/month on the free tier, LLM layer included. No card required.